CVE-2025-23780
Published: 16 January 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-23780 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the Easy Code Snippets WordPress plugin developed by Alpha BPO. The issue impacts all versions of the plugin from n/a through 1.0.2 and was published on 2025-01-16.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). High-privileged users, such as administrators, can exploit it remotely over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact confidentiality violations, such as unauthorized data extraction from the database, alongside low availability disruption and scope change to other resources.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/easy-code-snippets/vulnerability/wordpress-easy-code-snippets-plugin-1-0-2-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection enables high-privileged remote data extraction from the database, directly facilitating collection from information repositories (databases).