What is the CVSS score of CVE-2025-30628?

CVE-2025-30628 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Amazon Affiliates Addon are affected by CVE-2025-30628?

The AA-Team Amazon Affiliates Addon for WPBakery Page Builder (all versions through 1.2) contains a high-severity SQL injection vulnerability that requires an authenticated user session to exploit,…

How to fix or mitigate CVE-2025-30628?

Within 24 hours, inventory all WordPress installations using azon-addon-js-composer and audit active user accounts that could exploit the flaw. Within 7 days, either uninstall the plugin if not critical to business operations or implement Web Application Firewall (WAF) rules to block SQL injection attempts, and enable database query logging to detect exploitation attempts. Within 30 days, monitor vendor security advisories for a patch release, validate it in a staging environment, and deploy to production immediately once available; enforce least-privilege database access and multi-factor authentication for all user accounts with backend permissions to minimize exposure until patching is complete.

Amazon Affiliates Addon CVE-2025-30628

HIGH

SQL Injection (CWE-89)

2025-12-31 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Authenticated network SQLi (PR:L, AV:N, AC:L) with scope change to the DB and high confidentiality read; integrity untouched and only limited availability impact, matching the reported vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:32 vuln.today

CVE Published

Dec 31, 2025 - 20:15 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) azon-addon-js-composer allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through <= 1.2.

AnalysisAI

SQL injection in the AA-Team Amazon Affiliates Addon for WPBakery Page Builder (azon-addon-js-composer) WordPress plugin, affecting all versions from n/a through 1.2, allows authenticated attackers to inject arbitrary SQL into backend database queries. Because the CVSS vector carries PR:L, exploitation requires an authenticated (low-privilege) session, and the changed scope (S:C) plus high confidentiality impact means an attacker can read sensitive data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and the EPSS score is very low (0.04%), so mass exploitation is not currently indicated.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected component is azon-addon-js-composer, an add-on that integrates Amazon affiliate product functionality into the WPBakery Page Builder (formerly Visual Composer) page-building framework on WordPress. In this class of flaw, user-supplied input is concatenated into a SQL statement without parameterization or proper escaping - typically via WordPress's $wpdb query interface where a developer used raw string interpolation instead of $wpdb->prepare(). The Amazon Affiliates addon handles product/search parameters, and one or more of these inputs reaches a database query unsanitized, letting an attacker alter the query's logic against the underlying MySQL/MariaDB backend that stores WordPress data.

Affected ProductsAI

The affected product is the AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer), plugin slug azon-addon-js-composer, for WordPress. All versions up to and including 1.2 are affected (the advisory states 'from n/a through <= 1.2', so no lower bound is defined and every released version through 1.2 should be treated as vulnerable). No CPE string was provided in the input. The authoritative advisory is Patchstack: https://patchstack.com/database/wordpress/plugin/azon-addon-js-composer/vulnerability/wordpress-amazon-affiliates-addon-for-wpbakery-page-builder-formerly-visual-composer-1-2-sql-injection-vulnerability?_s_id=cve

RemediationAI

No vendor-released fixed version is identified in the available data - the advisory covers through <= 1.2 with no stated patched release, so treat this as no vendor-released patch confirmed at time of analysis and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/azon-addon-js-composer/vulnerability/wordpress-amazon-affiliates-addon-for-wpbakery-page-builder-formerly-visual-composer-1-2-sql-injection-vulnerability?_s_id=cve) and the AA-Team vendor page for an update beyond 1.2. Until a fixed version is published, the most effective compensating control is to deactivate and remove the azon-addon-js-composer plugin if the affiliate functionality is not business-critical (side effect: Amazon affiliate blocks rendered via this addon will stop working). If the plugin must remain active, restrict who holds authenticated accounts and disable open/self-service user registration or tighten default new-user roles (side effect: legitimate self-registration workflows break), and deploy a WordPress-aware WAF / virtual patch (Patchstack or equivalent) to filter SQL-injection payloads against the addon's endpoints (side effect: possible false positives on legitimate product queries). Also ensure database accounts used by WordPress have least-privilege grants to limit the blast radius of a successful injection.