What is the CVSS score of CVE-2025-24767?

CVE-2025-24767 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-24767?

A critical SQL injection vulnerability in the TicketBAI WooCommerce invoicing plugin (versions through 3.19) exposes affected e-commerce platforms to unauthorized database access and potential data…

How to fix or mitigate CVE-2025-24767?

Within 24 hours: Disable the TicketBAI plugin and switch to manual invoicing or alternative solutions; audit database access logs for suspicious activity. Within 7 days: Conduct forensic analysis to determine if the vulnerability was exploited; notify legal and compliance teams of potential data exposure. Within 30 days: Implement a Web Application Firewall (WAF) with SQL injection rules as a long-term compensating control; migrate to patched version immediately upon vendor release or identify permanent alternative plugin.

WordPress CVE-2025-24767

EUVD-2025-17479 CRITICAL

SQL Injection (CWE-89)

2025-06-09 audit@patchstack.com

WordPress SQLi

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17479

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Blind SQL Injection. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19.

AnalysisAI

Blind SQL Injection vulnerability in the TicketBAI Facturas para WooCommerce plugin (versions up to 3.19) that allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has a critical CVSS score of 9.3 with network-based attack vector requiring no privileges or user interaction, potentially enabling data exfiltration from WordPress database instances. Active exploitation status and proof-of-concept availability should be verified through KEV databases and security research channels.

Technical ContextAI

The vulnerability exists in the TicketBAI Facturas para WooCommerce plugin (CPE: wp:plugin:ticketbai-facturas-para-woocommerce), a WordPress extension that handles invoice generation and integration with the Spanish TicketBAI tax compliance system. The root cause is classified under CWE-89 (SQL Injection), specifically manifesting as Blind SQL Injection, where user-supplied input is improperly neutralized before being incorporated into SQL commands. Unlike standard SQL injection, blind variants do not return direct error messages, requiring attackers to infer data through boolean-based or time-based techniques. The plugin likely processes user input (potentially from WooCommerce order forms, invoice parameters, or API endpoints) without parameterized queries or prepared statements, allowing injection of SQL metacharacters directly into WHERE clauses or other query constructs.

RemediationAI

primary: Update TicketBAI Facturas para WooCommerce to version 3.20 or later immediately. Patch versions should be available through WordPress plugin repository or facturaone's official channels.; patch_availability: Check WordPress.org plugin page (https://wordpress.org/plugins/ticketbai-facturas-para-woocommerce/) for version 3.20+ release and changelog confirming SQL injection fix.; vendor_advisory: Contact facturaone or monitor their security advisories for official patch availability confirmation and timeline.; workarounds: {'temporary_mitigation': ['Disable the TicketBAI Facturas plugin if immediate patching is not possible', "Implement Web Application Firewall (WAF) rules blocking SQL injection patterns (e.g., UNION SELECT, --, /*) targeting the plugin's endpoints", 'Restrict plugin access via .htaccess or Nginx rules to trusted IP ranges if architecture permits', 'Monitor database logs for unusual SQL queries and access patterns indicative of exploitation attempts'], 'defense_in_depth': ['Implement principle of least privilege for WordPress database user credentials', 'Enable WordPress security plugins with SQL injection detection (Sucuri, Wordfence)', 'Keep WordPress core and all plugins updated to latest versions', 'Use prepared statements if custom code integrates with the plugin']}