What is the CVSS score of CVE-2025-30936?

CVE-2025-30936 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-30936

Q: Which versions of Wordpress Plugin are affected by CVE-2025-30936?

SQL injection vulnerability in Torod Company for Information Technology's Torod plugin through version 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands.

CRITICAL

SQL Injection (CWE-89)

2025-07-16 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.3 (CRITICAL)

Analysis Generated

Apr 01, 2026 - 17:26 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Torod Company for Information Technology Torod torod allows SQL Injection.This issue affects Torod: from n/a through <= 2.1.

AnalysisAI

SQL injection vulnerability in Torod Company for Information Technology's Torod plugin through version 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability affects all versions up to and including 2.1, with no CVSS vector provided but classified as SQL injection (CWE-89). No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in the Torod WordPress plugin, where user-supplied input is not properly sanitized or parameterized before being incorporated into SQL queries. The plugin fails to implement prepared statements or input validation, allowing attackers to manipulate SQL query logic. WordPress plugins are server-side components executed in PHP that directly interact with the WordPress database; improper neutralization of special SQL characters enables attackers to alter query structure and access or modify database contents beyond intended application logic.

Affected ProductsAI

Torod Company for Information Technology Torod plugin for WordPress in all versions from the earliest release through version 2.1 inclusive. The plugin is distributed via the WordPress plugin repository and indexed under the Patchstack vulnerability database.

RemediationAI

Update the Torod plugin to a version newer than 2.1 if available from the vendor, or disable and remove the plugin if no patched version is available. Implement input validation and prepared statements (parameterized queries) in any custom SQL code. Review the Patchstack vulnerability advisory at https://patchstack.com/database/Wordpress/Plugin/torod/vulnerability/wordpress-torod-1-9-sql-injection-vulnerability?_s_id=cve for detailed technical information and patched version availability. As an interim mitigation, restrict access to plugin functionality via Web Application Firewall rules that block SQL injection payloads.