What is the CVSS score of CVE-2025-49854?

CVE-2025-49854 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-49854?

A SQL injection vulnerability in Slim SEO (versions through 4.5.4) allows attackers to potentially extract or manipulate database content, including sensitive customer data and site configuration.

How to fix or mitigate CVE-2025-49854?

Within 24 hours: Identify all systems running Slim SEO and document version numbers; implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the affected plugin. Within 7 days: Disable or remove the Slim SEO plugin if business-critical functionality can be substituted; if retention is necessary, restrict access to the plugin's administrative interfaces via network segmentation or IP whitelisting. Within 30 days: Monitor vendor communications for patch availability; conduct database audit for unauthorized access or modifications; prepare to update immediately upon patch release.

Wordpress Plugin CVE-2025-49854

EUVD-2025-28317 HIGH

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28317

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anh Tran Slim SEO allows SQL Injection. This issue affects Slim SEO: from n/a through 4.5.4.

AnalysisAI

SQL Injection vulnerability in Anh Tran Slim SEO plugin (versions through 4.5.4) that allows high-privileged attackers to execute arbitrary SQL commands, potentially leading to data exfiltration and service disruption. The vulnerability requires administrator-level privileges to exploit, significantly limiting its real-world impact compared to unauthenticated SQL injection attacks. While the CVSS score of 7.6 indicates moderate-to-high severity, the privilege requirement (PR:H) substantially reduces the practical threat landscape.

Technical ContextAI

This vulnerability exists in the Slim SEO WordPress plugin (CPE: wp:slim-seo), a search engine optimization extension for WordPress. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL Injection flaw where user-supplied input is improperly sanitized before being incorporated into SQL queries. The plugin fails to use prepared statements or parameterized queries, allowing attackers with administrative credentials to inject malicious SQL syntax through unfiltered input fields. This affects all versions from initial release through version 4.5.4, indicating a long-standing code quality issue.