What is the CVSS score of CVE-2025-52714?

CVE-2025-52714 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Wordpress Theme CVE-2025-52714

CRITICAL

SQL Injection (CWE-89)

2025-07-16 audit@patchstack.com

WordPress SQLi Wordpress Theme

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.3 (CRITICAL)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.

AnalysisAI

SQL injection vulnerability in shinetheme Traveler WordPress theme versions before 3.2.2 allows attackers to execute arbitrary SQL commands through improper neutralization of special elements in SQL queries. The vulnerability affects all versions up to and including 3.2.1, with an extremely low EPSS score of 0.05% (17th percentile) suggesting minimal real-world exploitation probability despite the critical nature of SQL injection attacks.

Technical ContextAI

This vulnerability is classified as CWE-89 (SQL Injection), a foundational web application flaw where user-supplied input is inadequately sanitized before being incorporated into SQL queries. The affected product is the shinetheme Traveler theme for WordPress (CPE data not provided in source material, but identifiable as WordPress plugin/theme). SQL injection vulnerabilities typically arise from concatenating user input directly into dynamic SQL statements without parameterized queries or proper escaping, allowing attackers to inject malicious SQL syntax that alters query logic or exfiltrates data.

Affected ProductsAI

The vulnerability affects shinetheme Traveler WordPress theme from version 3.2.1 and earlier (all versions prior to 3.2.2). The exact affected version range is documented as "from n/a through < 3.2.2" per the vulnerability disclosure on Patchstack. No CPE string is provided in the source material.

RemediationAI

Update shinetheme Traveler WordPress theme to version 3.2.2 or later. Website administrators should access the WordPress dashboard, navigate to Themes, and apply the available update for Traveler. For detailed patch information and verification, refer to the official advisory on Patchstack at https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-3-2-2-sql-injection-vulnerability. If immediate patching is not feasible, disable the theme or restrict access to affected functionality until the update can be applied.