CVE-2025-22691
Published: 03 February 2025
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows SQL Injection.This issue affects WP Travel: from n/a through <= 10.1.3.
Security Summary
CVE-2025-22691 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, in the WP Travel WordPress plugin (wp-travel). This issue affects WP Travel versions from n/a through 10.1.3, allowing attackers to inject malicious SQL commands due to inadequate input sanitization.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). It can be exploited remotely over the network with low attack complexity by authenticated users possessing high privileges, without requiring user interaction. Successful exploitation enables high-impact confidentiality violations, such as unauthorized data access, alongside low availability disruption and a changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-travel/vulnerability/wordpress-wp-travel-plugin-10-1-0-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)