What is the CVSS score of CVE-2025-48118?

CVE-2025-48118 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-48118?

A critical SQL injection vulnerability in the WooCommerce Partial Shipment plugin (versions up to 3.2) exposes organizations using this extension to potential database compromise, data theft, and…

How to fix or mitigate CVE-2025-48118?

Within 24 hours: Audit all WooCommerce installations to identify systems running Woocommerce Partial Shipment plugin version 3.2 or earlier and document exposure scope. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the vulnerable plugin endpoints, isolate affected systems from production networks if critical, and contact the plugin vendor for patching timeline. Within 30 days: Deploy the vendor patch immediately upon release, conduct forensic analysis for evidence of exploitation, reset database credentials, and implement code review processes for third-party plugin dependencies.

WordPress CVE-2025-48118

EUVD-2025-18537 HIGH

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18537

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment allows SQL Injection. This issue affects Woocommerce Partial Shipment: from n/a through 3.2.

AnalysisAI

SQL injection vulnerability in WpExperts Hub's Woocommerce Partial Shipment plugin (versions up to 3.2) that allows authenticated attackers with low privileges to execute arbitrary SQL queries. The vulnerability has a CVSS score of 8.5 (High) with network accessibility and low attack complexity, enabling attackers to read sensitive database information and potentially disrupt service availability. The attack requires valid user credentials but no special interaction, making it a significant risk for multi-user WordPress/WooCommerce installations.

Technical ContextAI

This vulnerability stems from improper neutralization of special characters in SQL commands (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) within the WpExperts Hub Woocommerce Partial Shipment plugin. The root cause is the failure to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. The affected product is a WordPress WooCommerce extension (CPE pattern: wp:woocommerce_partial_shipment or similar plugin identifier) that handles shipment processing in e-commerce environments. The vulnerability likely exists in shipment query filtering, order processing, or tracking features where user input is concatenated directly into database queries without using prepared statements or parameterized queries.

RemediationAI

Immediate actions: (1) Update Woocommerce Partial Shipment plugin to version 3.3 or later (patch details should be verified on WpExperts Hub official repository or WordPress.org plugin page). (2) If patch unavailable, immediately disable the plugin and use alternative shipment handling until patched. (3) Conduct database audit to identify suspicious queries in logs from the plugin's query endpoints. Longer-term mitigations: (1) Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in shipment-related requests. (2) Apply principle of least privilege—restrict admin/shipment management access to trusted staff only. (3) Use WordPress security plugins (e.g., Wordfence, Sucuri) to monitor for SQL injection attempts. (4) Enable WordPress database query logging to detect exploitation. Vendor advisory: Check WpExperts Hub official website and WordPress.org Woocommerce Partial Shipment plugin page for patch release notes and timeline.