Cyber Posture

CVE-2025-28939

High

Published: 26 March 2025

Published
26 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0016 36.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-28939 is an improper neutralization of special elements used in an SQL command, classified as a Blind SQL Injection vulnerability (CWE-89), affecting the WP Google Calendar Manager plugin (wp-gcalendar) for WordPress developed by EuroCizia. The issue impacts all versions from n/a through 2.1 inclusive, with a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).

Low-privileged authenticated users can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high confidentiality impact through data exfiltration via blind SQL injection techniques, low availability disruption, and scope change affecting the broader system, while integrity remains unaffected.

Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/wp-gcalendar/vulnerability/wordpress-wp-google-calendar-manager-plugin-2-1-sql-injection-vulnerability?_s_id=cve, provide further details on the vulnerability and recommended mitigations.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Blind SQL injection in public-facing WordPress plugin directly enables exploitation of the web application for data exfiltration.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References