CVE-2025-22540
Published: 09 January 2025
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in seballero Emailing Subscription email-suscripcion allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through <= 1.4.1.
Security Summary
CVE-2025-22540 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, enabling Blind SQL Injection (CWE-89), in the seballero Emailing Subscription WordPress plugin (email-suscripcion). Published on 2025-01-09, it affects all versions of the plugin from its initial release through 1.4.1.
The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), making it exploitable by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Exploitation changes the scope and allows high confidentiality impact through data extraction from the database, alongside low availability impact.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/email-suscripcion/vulnerability/wordpress-emailing-subscription-plugin-1-4-1-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)