CVE-2025-24659
Published: 24 January 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-24659 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the Shahjada WPDM – Premium Packages plugin (wpdm-premium-packages) for WordPress. The flaw affects all versions from n/a through 5.9.6 and is classified under CWE-89.
Attackers with high privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation changes scope and results in high confidentiality impact (allowing data extraction), low availability impact, and no integrity impact, consistent with the CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L).
The Patchstack advisory provides further details on this vulnerability, including vulnerability assessment for the WordPress Premium Packages plugin up to version 5.9.6, accessible at https://patchstack.com/database/Wordpress/Plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-sell-digital-products-securely-plugin-5-9-6-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection vulnerability in public-facing WordPress plugin directly enables T1190 for application exploitation and facilitates T1213.006 for database data extraction via blind queries.