Cyber Posture

CVE-2025-28942

Critical

Published: 26 March 2025

Published
26 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0009 26.2th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-28942 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the Trust Payments Gateway for WooCommerce plugin, specifically the trust-payments-hosted-payment-pages-integration component. This issue impacts all versions from n/a through 1.1.4 inclusive. The vulnerability was published on 2025-03-26 and carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), highlighting its critical severity due to network accessibility and lack of prerequisites.

Remote unauthenticated attackers can exploit this SQL Injection flaw over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact confidentiality violations, such as extracting sensitive data from the database, alongside low availability disruption and a changed scope that extends consequences beyond the vulnerable component.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/trust-payments-hosted-payment-pages-integration/vulnerability/wordpress-trust-payments-gateway-for-woocommerce-plugin-1-1-4-sql-injection-vulnerability?_s_id=cve provides further details on this WordPress plugin vulnerability, including mitigation guidance for affected installations.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing WooCommerce plugin enables remote exploitation of web application (T1190) and direct database data extraction (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References