Cyber Posture

CVE-2025-30524

Critical

Published: 26 March 2025

Published
26 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0009 26.2th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-30524 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as SQL Injection (CWE-89), affecting the origincode Product Catalog WordPress plugin in its displayproduct component. This issue impacts versions from n/a through 1.0.4, as published on 2025-03-26.

The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), making it exploitable by unauthenticated remote attackers with low attack complexity and no user interaction required. Exploitation changes the scope and enables high confidentiality impact through data extraction from the database, alongside low availability impact.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/displayproduct/vulnerability/wordpress-product-catalog-plugin-1-0-4-sql-injection-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The SQL Injection vulnerability in a publicly accessible WordPress plugin directly enables exploitation of public-facing applications (T1190) for unauthenticated remote data access from the database.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References