CVE-2025-22699

CVE-2025-22699 is an SQL injection vulnerability (CWE-89) in the Traveler Code WordPress plugin developed by shinetheme. The flaw stems from improper neutralization of special elements used in an SQL command within the traveler-code component. It affects all versions of the plugin from its initial release through versions prior to 3.1.2. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation across confidentiality, integrity, and availability.

Unauthenticated attackers with network access can exploit this vulnerability, though it requires high attack complexity. Successful exploitation enables arbitrary SQL execution, allowing attackers to read, modify, or delete database contents. The changed scope (S:C) amplifies the impact, potentially compromising the entire WordPress site's backend data and functionality without requiring user interaction or privileges.

Patchstack's advisory on the vulnerability, accessible via its database entry, highlights the unauthenticated arbitrary SQL execution risk specifically in Traveler Code plugin versions up to 3.1.0 and recommends updating to version 3.1.2 or later as the primary mitigation. No additional workarounds are detailed in the provided references.