What is the CVSS score of CVE-2025-49263?

CVE-2025-49263 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-49263?

A SQL injection vulnerability affecting WC Vendors Marketplace versions through 2.5.6 could allow attackers to extract sensitive database information from affected e-commerce platforms.

How to fix or mitigate CVE-2025-49263?

Within 24 hours: audit all WC Vendors Marketplace installations to identify affected versions (≤2.5.6) and document exposure scope. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns, restrict database user permissions to least-privilege access, and disable marketplace vendor functionality if business operations permit. Within 30 days: contact vendor for patch availability timeline, evaluate migration to alternative marketplace solutions, or prepare emergency patching procedures upon vendor release.

Wordpress Plugin CVE-2025-49263

EUVD-2025-17284 HIGH

SQL Injection (CWE-89)

2025-06-06 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17284

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WCVendors WC Vendors Marketplace allows Blind SQL Injection. This issue affects WC Vendors Marketplace: from n/a through 2.5.6.

AnalysisAI

Blind SQL injection vulnerability in WC Vendors Marketplace plugin versions through 2.5.6 that allows authenticated attackers with high privileges (administrator or vendor) to extract sensitive database information without direct output visibility. The vulnerability has a CVSS score of 7.6 with high confidentiality impact, though integrity is not compromised and availability impact is low. No publicly available exploit code or active exploitation has been confirmed at this time, but the attack requires only network access and high privilege authentication.

Technical ContextAI

This vulnerability exists in the WC Vendors Marketplace WordPress plugin (vendor: 'WCVendors'), a multi-vendor marketplace solution built as a WooCommerce extension. The root cause is CWE-89: Improper Neutralization of Special Elements used in an SQL Command, indicating unsanitized or unparameterized user input being directly concatenated into SQL queries. The blind SQL injection variant is particularly concerning because the attacker cannot see query results directly in application responses; instead, they must infer database structure and content through time-based or boolean-based inference techniques. The vulnerability likely exists in marketplace query functions, user data retrieval, or vendor-specific database operations where input validation was insufficient or parameterized queries were not implemented.