What is the CVSS score of CVE-2025-31424?

CVE-2025-31424 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-31424?

A critical SQL injection vulnerability in the WP Lead Capturing Pages WordPress plugin (versions through 2.3) allows attackers to extract sensitive database information without authentication.

How to fix or mitigate CVE-2025-31424?

Within 24 hours: Audit all WordPress installations for WP Lead Capturing Pages plugin presence and version; disable the plugin immediately on affected sites. Within 7 days: Conduct forensic analysis of database access logs and user activity for signs of exploitation; consider full database credential rotation. Within 30 days: Either update to a patched version when available or uninstall the plugin completely and migrate to an alternative lead capture solution with security review.

Wordpress Plugin CVE-2025-31424

EUVD-2025-17500 CRITICAL

SQL Injection (CWE-89)

2025-06-09 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17500

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages allows Blind SQL Injection. This issue affects WP Lead Capturing Pages: from n/a through 2.3.

AnalysisAI

Blind SQL Injection vulnerability in the WP Lead Capturing Pages WordPress plugin (versions through 2.3) that allows unauthenticated remote attackers to extract sensitive data from the database without leaving obvious traces. The vulnerability has a critical CVSS score of 9.3 due to its network-accessible attack vector, low complexity, and requirement for no privileges or user interaction. While specific KEV or active exploitation status is not confirmed in available intelligence, the high CVSS, blind SQL injection nature, and broad applicability across WordPress installations make this a priority for remediation.

Technical ContextAI

This vulnerability exploits improper input sanitization in the WP Lead Capturing Pages plugin (CPE: wp:wp-lead-capturing-pages or vendor-specific WordPress plugin identifier), a WordPress plugin used for lead capture functionality. The root cause is CWE-89 (SQL Injection), where user-controlled input is directly concatenated into SQL queries without proper parameterized queries or escaping. Blind SQL injection specifically allows attackers to infer database structure and content through time-based or boolean-based inference techniques (observing response timing differences or true/false conditions), rather than direct error-based feedback. WordPress plugins are executed with database privileges in the hosting environment, making them a high-value target for data extraction attacks.

RemediationAI

patch: Update WP Lead Capturing Pages plugin to version 2.4 or later (version details to be confirmed from vendor advisory); priority: immediate workaround: If immediate patching is not possible, disable the WP Lead Capturing Pages plugin and remove from active plugins list until patched version is available mitigation: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests, specifically blind SQL injection signatures (time-based delays, conditional responses) detection: Monitor database query logs and web server access logs for suspicious patterns: unusual sleep() or BENCHMARK() statements, IF() conditions, OR 1=1 patterns, and time-based response anomalies mitigation: Restrict database user privileges used by WordPress to only necessary permissions; avoid using database admin credentials for WordPress connection