Capella CVE-2025-15688

Exploitation requires only that the target WordPress site has the Capella theme (version <= 2.5.5) active and its vulnerable request path reachable over the network; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration prerequisite documented - remote unauthenticated exploitation against default installations of the Capella theme. The main limiting factors are deployment scope (the site must actually run this specific theme, which is a niche premium theme rather than core WordPress) and the impact ceiling: the flaw yields database read (C:H) with no integrity impact (I:N) and only low availability impact, so it enables data theft rather than direct code execution or content modification. The exact vulnerable parameter is not specified in the provided data and should be confirmed from the Patchstack advisory.

The signals point to a genuine high-priority issue rather than an inflated CVSS score. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L describes a network-reachable, low-complexity, unauthenticated, no-interaction attack - the easiest class to exploit - and the scope change (S:C) plus high confidentiality impact reflects that a theme-layer flaw can read the shared WordPress database beyond the vulnerable component's own data. Integrity is rated none and availability only low, so this is primarily a data-disclosure vulnerability rather than a full site-takeover primitive, though disclosed password hashes or secrets could enable follow-on compromise. No EPSS score, KEV listing, or POC indicator was supplied, so probabilistic and active-exploitation data are simply absent - this should be treated as unknown, not as low risk, and any operator running Capella should treat unauthenticated SQLi as urgent given how trivially SQL injection in public themes is weaponized. Because no patched version is present in the input, the practical risk is bounded mainly by how many sites still run Capella, not by attacker difficulty.

A remote attacker with no account crafts an HTTP request to a Capella-powered WordPress site, injecting SQL into the vulnerable parameter to make the backend query return arbitrary rows. Because the impact is confidentiality-focused with a scope change, the attacker enumerates and exfiltrates data such as usernames and password hashes from wp_users, then uses those credentials to attempt authenticated access elsewhere. No public exploit code is identified at time of analysis, but SQL injection of this class is straightforward to reproduce with common tooling.