What is the CVSS score of CVE-2025-49323?

CVE-2025-49323 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-49323?

A high-severity SQL injection vulnerability in Themefic Hydra Booking (versions up to 1.1.10) allows attackers to manipulate database queries, potentially exposing sensitive customer and booking…

How to fix or mitigate CVE-2025-49323?

Within 24 hours: identify all instances of Hydra Booking in your environment and isolate affected systems from public internet access; notify affected customers of potential exposure. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns, enable database activity monitoring, and conduct urgent security assessment of booking data access logs. Within 30 days: migrate to alternative booking solution, coordinate with Themefic for patch timeline, or apply vendor patch once released.

Wordpress Plugin CVE-2025-49323

EUVD-2025-17249 HIGH

SQL Injection (CWE-89)

2025-06-06 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17249

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking allows SQL Injection. This issue affects Hydra Booking: from n/a through 1.1.10.

AnalysisAI

SQL injection vulnerability in Themefic Hydra Booking plugin versions through 1.1.10 that allows authenticated attackers to execute arbitrary SQL queries. An attacker with user-level privileges can manipulate SQL commands to extract sensitive database information, bypass authentication, or modify data without user interaction. This vulnerability has a CVSS score of 8.5 (High) and represents a significant risk to WordPress installations using affected versions of the plugin.

Technical ContextAI

The vulnerability exists in the Hydra Booking WordPress plugin, a booking management solution. The root cause is improper neutralization of special SQL characters (CWE-89: SQL Injection), indicating that user-supplied input is concatenated directly into SQL queries without proper parameterization or prepared statements. The affected component likely processes booking-related data, search filters, or administrative functions that construct database queries. The plugin is distributed through WordPress.org plugin repository (CPE would be cpe:2.3:a:themefic:hydra-booking:*:*:*:*:*:wordpress:*:*). The vulnerability requires an authenticated user (PR:L in CVSS vector), meaning either a legitimate user account or compromised credentials are needed as an initial foothold.

RemediationAI

Navigate to WordPress Admin Dashboard > Plugins > Hydra Booking > Update to latest version Mitigation (if patch unavailable): WordPress Admin > Plugins > Deactivate Hydra Booking Detection: Review wp-content/debug.log and database error logs for SQL errors containing booking-related queries Access Control: WordPress Admin > Users > Review and remove excessive permissions