What is the CVSS score of CVE-2025-49315?

CVE-2025-49315 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-49315?

A SQL injection vulnerability in the Persian Woocommerce SMS plugin (versions through 7.0.10) could allow attackers to extract sensitive customer and business data from affected WordPress…

How to fix or mitigate CVE-2025-49315?

Within 24 hours: Identify all WordPress instances running Persian Woocommerce SMS and document the installed version. Within 7 days: Implement a Web Application Firewall (WAF) with rules blocking SQL injection payloads targeting this plugin, or disable the plugin entirely if business operations permit. Within 30 days: Monitor vendor communications for security patches and plan immediate deployment upon release; consider alternative SMS solutions if patch timeline is unclear.

WordPress CVE-2025-49315

EUVD-2025-17254 HIGH

SQL Injection (CWE-89)

2025-06-06 audit@patchstack.com

SQLi WordPress

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17254

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PersianScript Persian Woocommerce SMS allows SQL Injection. This issue affects Persian Woocommerce SMS: from n/a through 7.0.10.

AnalysisAI

CVE-2025-49315 is an SQL injection vulnerability in PersianScript's Persian Woocommerce SMS plugin affecting versions up to 7.0.10. An authenticated attacker with high privileges (administrator or above) can inject arbitrary SQL commands to read sensitive database information and cause denial of service. While the CVSS score is 7.6 (high), the requirement for elevated privileges (PR:H) and lack of integrity impact limit real-world exploitability, though the cross-site scope elevation and confirmed existence of this vulnerability class in WordPress plugins warrant immediate patching.

Technical ContextAI

The vulnerability exists in the PersianScript Persian Woocommerce SMS plugin (CPE: cpe:2.3:a:persianscript:persian_woocommerce_sms:*:*:*:*:*:wordpress:*:*), which is a WordPress plugin designed to integrate SMS functionality with WooCommerce e-commerce systems. The root cause is CWE-89: Improper Neutralization of Special Elements used in an SQL Command, indicating that user-supplied input is concatenated directly into SQL queries without parameterized preparation or proper escaping. This is a classic SQL injection flaw where database-special characters (quotes, semicolons, comment syntax) are not sanitized before database execution. The plugin's failure to use WordPress's built-in wpdb prepared statements ($wpdb->prepare()) or parameterized queries creates a direct path to unauthorized database access.

RemediationAI

Update to version 7.0.11 or later if available from PersianScript; details: Check the PersianScript official website or WordPress plugin repository for patched versions. No specific patch version is disclosed in the CVE description; contact vendor or monitor wordpress.org/plugins/persian-woocommerce-sms/ for updates. Workaround: Disable the Persian Woocommerce SMS plugin if not actively in use; details: Deactivate and optionally delete the plugin from WordPress admin panel if SMS functionality is not critical. Mitigation: Restrict administrative access; details: Limit the number of user accounts with administrator privileges; implement strong authentication (2FA/MFA) for all admin accounts; audit admin user list regularly and remove unnecessary accounts. Mitigation: Database access controls; details: Implement principle of least privilege: ensure the WordPress database user has minimal required permissions; consider read-only database user for non-administrative functions if possible. Monitoring: Log and monitor SQL errors and database queries; details: Enable WordPress debug logging; use database query logging or WAF rules to detect SQL injection attempts (UNION, SELECT, comment syntax in request parameters).