CVE-2025-22639
Published: 18 February 2025
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance-rate-shipping-for-woocommerce-pro allows Blind SQL Injection.This issue affects Distance Rate Shipping for WooCommerce: from n/a through <= 1.3.4.
Security Summary
CVE-2025-22639 is an SQL Injection vulnerability involving improper neutralization of special elements used in an SQL command, enabling Blind SQL Injection, as classified under CWE-89. It affects the Techspawn Distance Rate Shipping for WooCommerce Pro plugin (distance-rate-shipping-for-woocommerce-pro), impacting all versions from n/a through 1.3.4 inclusive. The vulnerability was published on 2025-02-18 and carries a CVSS v3.1 base score of 8.5.
Low-privileged authenticated users can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation results in high confidentiality impact through data extraction via blind SQL injection, low availability impact, no integrity impact, and a changed scope, allowing attackers to access sensitive database information beyond the plugin's intended privileges.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/distance-rate-shipping-for-woocommerce-pro/vulnerability/wordpress-distance-rate-shipping-for-woocommerce-plugin-1-3-4-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)