CVE-2025-22542
Published: 09 January 2025
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Blind SQL Injection.This issue affects Virtual Bot: from n/a through <= 1.0.0.
Security Summary
CVE-2025-22542 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the Virtual Bot WordPress plugin developed by Ofek Nakar. The vulnerability affects all versions of the plugin from n/a through 1.0.0.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation allows high-impact confidentiality breaches, such as extracting sensitive data from the database via blind SQL injection techniques, with a changed scope, no integrity impact, and low availability impact. The CVSS 3.1 base score is 9.3, reflected in the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
Mitigation details are provided in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/virtual-bot/vulnerability/wordpress-virtual-bot-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve, which covers the SQL injection vulnerability in the WordPress Virtual Bot plugin version 1.0.0.
Details
- CWE(s)