What is the CVSS score of CVE-2025-49327?

CVE-2025-49327 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-49327?

A SQL injection vulnerability in ShortLinks Pro (versions through 1.0.7) allows attackers to manipulate database queries, potentially exposing sensitive data or modifying business-critical…

How to fix or mitigate CVE-2025-49327?

Within 24 hours: Identify all instances of ShortLinks Pro across your environment and assess exposure (internal vs. public-facing). Within 7 days: Implement compensating controls including WAF rules to block SQL injection patterns, disable the ShortLinks Pro plugin if not business-critical, or restrict access via network segmentation. Within 30 days: Monitor vendor for patch availability; evaluate alternative URL shortening solutions; conduct database audit for unauthorized access or modifications.

Wordpress Plugin CVE-2025-49327

EUVD-2025-17245 HIGH

SQL Injection (CWE-89)

2025-06-06 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17245

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia ShortLinks Pro allows SQL Injection. This issue affects ShortLinks Pro: from n/a through 1.0.7.

AnalysisAI

SQL injection vulnerability in Ruben Garcia ShortLinks Pro versions up to 1.0.7 that allows authenticated attackers with high privileges to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.6 (High) and affects the ShortLinks Pro WordPress plugin; while the attack requires elevated privileges, successful exploitation could lead to unauthorized data access and limited system availability impacts. No active exploitation in the wild or public POC has been widely reported at this time, though the SQL injection class (CWE-89) remains a critical attack vector.

Technical ContextAI

The vulnerability stems from improper neutralization of special SQL metacharacters in user-supplied input, a classic SQL injection flaw (CWE-89). ShortLinks Pro, a WordPress plugin for URL shortening, fails to properly sanitize or parameterize SQL queries when processing user input. The affected product is identified by CPE: vendor=ruben-garcia, product=shortlinks-pro, versions=1.0.0 through 1.0.7. The root cause is the lack of prepared statements or parameterized queries, allowing attackers to break out of intended SQL syntax and inject malicious SQL commands. This is a direct application of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), one of the OWASP Top 10 and CWE Top 25 most dangerous weakness classes.