What is the CVSS score of CVE-2025-24773?

CVE-2025-24773 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-24773?

A critical SQL injection vulnerability affecting the WPCRM plugin (versions up to 3.2.0) allows attackers to potentially access, modify, or delete sensitive customer and contact data stored in…

How to fix or mitigate CVE-2025-24773?

Within 24 hours: Disable the WPCRM plugin immediately and audit database access logs for suspicious activity. Within 7 days: Inventory all affected WordPress installations and assess whether plugin functionality can be replaced with alternative solutions; if continued use is mandatory, implement WAF rules to block SQL injection patterns targeting the plugin. Within 30 days: Monitor vendor's security advisories for patch availability; evaluate and test migration to patched versions or alternative CRM plugins that meet business requirements.

WordPress CVE-2025-24773

EUVD-2025-18522 CRITICAL

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18522

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce allows SQL Injection. This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through 3.2.0.

AnalysisAI

Critical SQL injection vulnerability in the WPCRM plugin (versions up to 3.2.0) for WordPress, affecting deployments integrating Contact Form 7 and WooCommerce. An unauthenticated remote attacker can execute arbitrary SQL commands with high confidence (CVSS 9.3, EPSS score likely elevated) to extract sensitive customer relationship and transaction data, though direct data modification and system availability impacts are limited. Immediate patching is strongly recommended for all affected installations.

Technical ContextAI

WPCRM is a WordPress plugin (CPE: wp:mojoomla:wpcrm) that bridges Contact Form 7 contact submissions and WooCommerce e-commerce data into a unified CRM system. The vulnerability stems from improper input validation and parameterization in SQL query construction (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). Rather than using prepared statements or parameterized queries, the plugin likely concatenates user-supplied input directly into SQL WHERE, INSERT, or SELECT clauses. The attack surface includes contact form parameters, WooCommerce order/customer data, and API endpoints exposed by the plugin. The plugin operates within WordPress's database abstraction layer, meaning successful SQL injection grants access to the wp_* table namespace and potentially sensitive customer PII, order history, and CRM contact records.

RemediationAI

Immediate Actions: (1) Update WPCRM plugin to version 3.2.1 or later (patch version not explicitly provided in CVE description; verify via WordPress.org plugin repository or mojoomla's website). (2) If update is unavailable, disable the WPCRM plugin immediately and switch to alternative CRM integration (e.g., Elementor CRM, HubSpot for WordPress, native WooCommerce CRM features). Short-term Workarounds: (1) Restrict database user permissions: create a dedicated WordPress database user with SELECT-only privileges and revoke INSERT/UPDATE/DELETE on sensitive tables (wp_posts, wp_postmeta, wp_users). (2) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in plugin endpoints (e.g., block requests containing UNION, SELECT, OR 1=1 in POST/GET parameters). (3) Enable WordPress security plugins (Wordfence, Sucuri) to monitor for SQL injection attack attempts. Long-term: (1) Apply the official patch once released by mojoomla. (2) Conduct security code review of WPCRM source code to audit for similar SQL injection flaws in other database queries. (3) Implement automated dependency scanning in CI/CD pipelines. Vendor Advisory: Check mojoomla's official website and WordPress.org plugin page for patch release notes and CVE acknowledgment.