What is the CVSS score of CVE-2025-5017?

CVE-2025-5017 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Zoho CRM Plugin CVE-2025-5017

EUVD-2025-210456 MEDIUM

SQL Injection (CWE-89)

2026-07-11 Wordfence

GHSA-8622-4f89-rc6w

WordPress SQLi Zoho Catalyst Connect Zoho Crm Client Portal

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

PR:H confirmed by Administrator credential requirement; AV:N reflects web-accessible WordPress endpoint; C:H for full database read; I:N and A:N as injection is read-only.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 07:10 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based blind SQL injection in the Catalyst Connect Zoho CRM Client Portal WordPress plugin (all versions ≤ 2.2.0) enables authenticated administrators to exfiltrate arbitrary data from the underlying WordPress database via the unsanitized 'uid' parameter. The CVSS vector (PR:H) confirms exploitation requires administrator-level credentials, meaningfully constraining the attack surface. A public proof-of-concept is available on GitHub (BFS-Lab/BFSDV), and no confirmed patch version has been identified in available intelligence at time of analysis.

Technical ContextAI

The affected product is the Catalyst Connect Zoho CRM Client Portal WordPress plugin (CPE: cpe:2.3:a:catalyst2020:catalyst_connect_zoho_crm_client_portal:*:*:*:*:*:*:*:*), which bridges WordPress sites with Zoho CRM to deliver a customer-facing portal experience. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands): the 'uid' parameter is passed directly into an existing SQL query without adequate escaping or parameterization via prepared statements. The time-based blind variant means the injected payload manipulates database execution timing (e.g., SLEEP or BENCHMARK functions) rather than returning data directly in the response, requiring the attacker to infer database contents from observable latency differences. This technique is slower and noisier than union- or error-based injection but does not require error output visibility, making it viable against hardened configurations.

RemediationAI

No vendor-released patched version has been identified in any available source at time of analysis - the WordPress.org plugin page (https://wordpress.org/plugins/catalyst-connect-client-portal/) and the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/37ce28de-f41d-42f8-8467-0af5e643a739) should be monitored for an updated release. The most effective immediate mitigation is to deactivate and remove the plugin if the Zoho CRM client portal functionality is non-critical, eliminating the attack surface entirely. If the plugin must remain active, restrict WordPress admin panel access to known trusted IP addresses using server-level firewall rules or a security plugin with IP allowlisting - this directly counters the PR:H requirement by preventing unauthorized sessions from reaching the vulnerable parameter. Additionally, audit all administrator-level WordPress accounts, enforce strong unique passwords, and enable multi-factor authentication to reduce risk of credential compromise that would enable exploitation. Note that IP restriction may break legitimate remote admin workflows and should be coordinated with site administrators.