What is the CVSS score of CVE-2025-49931?

CVE-2025-49931 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-49931?

Crocoblock JetSearch plugin versions up to 3.5.10 contain a critical blind SQL injection vulnerability that allows unauthenticated attackers to extract sensitive data from WordPress databases without…

How to fix or mitigate CVE-2025-49931?

Within 24 hours: Identify all WordPress installations using Crocoblock JetSearch plugin and document current versions via admin dashboard or WordPress plugin audit tools. Within 7 days: Disable or deactivate the JetSearch plugin on all affected sites until a patched version is available; alternatively, restrict public access to search functionality via Web Application Firewall rules blocking POST/GET requests to affected endpoints. Within 30 days: Monitor Crocoblock's official repository and security advisories for patch release; conduct database audit for unauthorized access logs correlating with plugin deployment dates; implement WordPress security hardening including database activity monitoring.

Wordpress Plugin CVE-2025-49931

CRITICAL

SQL Injection (CWE-89)

2025-10-22 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through <= 3.5.10.

AnalysisAI

Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.

Technical ContextAI

JetSearch is a WordPress plugin by Crocoblock that provides AJAX-powered search functionality for WordPress sites. This vulnerability stems from improper sanitization of user-supplied input in SQL queries (CWE-89), specifically manifesting as a blind SQL injection attack vector. In blind SQLi attacks, attackers cannot see query results directly but can infer database contents through timing delays or boolean-based conditional responses. The plugin's search parameter processing fails to adequately neutralize special SQL metacharacters, allowing attackers to inject malicious SQL commands that execute in the context of the WordPress database connection. All JetSearch versions through 3.5.10 are confirmed affected based on CPE data, indicating a longstanding input validation weakness in the plugin's search query handling mechanism.

Affected ProductsAI

This vulnerability affects Crocoblock JetSearch plugin for WordPress in all versions from initial release through version 3.5.10 inclusive. JetSearch is a premium WordPress plugin providing advanced AJAX search capabilities, typically deployed on e-commerce and content-heavy WordPress sites using the Crocoblock ecosystem. The vulnerability was reported by the Patchstack security research team (audit@patchstack.com). Organizations running WordPress installations with JetSearch plugin versions 3.5.10 or earlier should consider themselves affected. Detailed vulnerability information is available in the Patchstack database advisory at https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-10-sql-injection-vulnerability.

RemediationAI

Immediately upgrade JetSearch plugin to version 3.5.11 or later, which addresses the SQL injection vulnerability through improved input validation and parameterized query implementation. Access the update through the WordPress plugin dashboard or download directly from Crocoblock's official distribution channels. If immediate patching is not feasible, implement temporary mitigations including disabling the JetSearch plugin until upgrade is possible, restricting search functionality to authenticated users only through WordPress role configuration, and deploying web application firewall (WAF) rules to detect and block SQL injection patterns in search parameters. Database monitoring for suspicious queries containing SQL metacharacters (UNION, SELECT, SLEEP, BENCHMARK) originating from search endpoints can provide detection coverage. Organizations should review WordPress database access logs for the period during which vulnerable versions were deployed to identify potential exploitation attempts. Full vulnerability details and remediation guidance are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-10-sql-injection-vulnerability.