CVE-2025-24663
Published: 24 January 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-24663 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, specifically enabling Blind SQL Injection (CWE-89), in the mra13 Simple Download Monitor WordPress plugin (simple-download-monitor). This issue affects all versions from n/a through 3.9.25, as published on 2025-01-24.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating exploitation over the network with low attack complexity by users possessing high privileges, requiring no user interaction. Attackers can achieve high confidentiality impact through data extraction via blind SQL injection, with scope changed to cross-component effects and low impacts on integrity and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simple-download-monitor/vulnerability/wordpress-simple-download-monitor-plugin-3-9-25-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The blind SQL injection vulnerability in the public-facing WordPress plugin directly enables T1190 (exploitation of public-facing applications for initial access) and facilitates T1213.006 (data collection from databases via unauthorized SQL queries for high-impact data extraction).