CVE-2025-30806
Published: 27 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-30806 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, in the Vimeotheque WordPress plugin (codeflavors-vimeo-video-post-lite) developed by Constantin Boiangiu. This issue affects the plugin from n/a through version 2.3.4.2. The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating high severity due to its network accessibility and potential for significant impact.
The vulnerability can be exploited by low-privileged authenticated users (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation changes the scope (S:C), enabling high confidentiality impact (C:H) such as unauthorized access to sensitive database information, alongside low availability impact (A:L) and no integrity impact (I:N).
Patchstack provides details on the vulnerability, including mitigation guidance, in their advisory at https://patchstack.com/database/Wordpress/Plugin/codeflavors-vimeo-video-post-lite/vulnerability/wordpress-vimeotheque-plugin-2-3-4-2-sql-injection-vulnerability?_s_id=cve. Security practitioners should consult this reference for patch availability and remediation steps.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in a WordPress plugin directly enables exploitation of a public-facing web application (T1190) for unauthorized database access.