What is the CVSS score of CVE-2025-52717?

CVE-2025-52717 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of LifterLMS are affected by CVE-2025-52717?

LifterLMS, a WordPress plugin used for learning management and course delivery, contains an unauthenticated SQL injection vulnerability (CVE-2025-52717, CVSS 9.3) that permits attackers to extract…

How to fix or mitigate CVE-2025-52717?

Within 24 hours, identify all WordPress installations running LifterLMS versions 8.0.6 or earlier and immediately deactivate the plugin, or restrict inbound access to its database queries at the network layer if operational continuity requires plugin operation. Within 7 days, deploy Web Application Firewall (WAF) rules blocking SQL injection payloads targeting the vulnerable endpoints, enable database query logging with alerting on suspicious SQL patterns, and audit recent database access logs for evidence of exploitation. Within 30 days, continuously monitor Patchstack and LifterLMS official advisories for patch release; upon availability, test and deploy the vendor patch to all affected installations within 48 hours, and conduct forensic review of database logs and user account activity for indicators of compromise.

LifterLMS CVE-2025-52717

EUVD-2025-19292 CRITICAL

SQL Injection (CWE-89)

2025-06-27 audit@patchstack.com

WordPress SQLi Lifterlms Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network SQLi is low-complexity and typically enables reading (C:H) and some data modification (I:L); PR:L reflects that comparable WordPress plugin SQLi commonly needs a low-privileged account, and DB access does not cross a security authority (S:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 21:12 vuln.today

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19292

CVE Published

Jun 27, 2025 - 12:15 cve.org

CRITICAL 9.3

CVE Published

Jun 27, 2025 - 12:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS allows SQL Injection. This issue affects LifterLMS: from n/a through 8.0.6.

AnalysisAI

SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.

Technical ContextAI

LifterLMS is a learning-management-system (LMS) plugin for WordPress used to build and sell online courses and memberships; the CPE cpe:2.3:a:lifterlms:lifterlms:*:*:*:*:*:wordpress:*:* identifies it as the affected component. The root cause is CWE-89: user-controllable input is concatenated into a SQL statement executed against the WordPress MySQL/MariaDB backend without proper parameterization or escaping (e.g., missing use of $wpdb->prepare()). Because WordPress plugins share the site database, a successful injection reaches the same tables that hold wp_users credentials hashes, session/nonce data, and other plugin content, which is consistent with the confidentiality-focused, scope-changed vector Patchstack assigned.

RemediationAI

Upgrade LifterLMS to the first release after 8.0.6 that the vendor marks as fixed (a released patched version is not independently confirmed in the available data - confirm the exact fixed version on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/lifterlms/vulnerability/wordpress-lifterlms-8-0-6-sql-injection-vulnerability?_s_id=cve before deploying, and do not rely on an invented version number). Until a confirmed patch is applied, deploy a WordPress WAF or virtual patch (Patchstack and comparable WAFs publish rules for this CVE) to filter SQL injection payloads against LifterLMS endpoints; the trade-off is possible false positives on legitimate course/query parameters. As additional compensating controls, restrict access to LifterLMS admin and AJAX/REST endpoints to trusted users, remove or deactivate the plugin if it is not in active use (this disables all LMS functionality), and take a verified database backup plus rotate WordPress salts/keys and force credential resets if you suspect the injectable query already exposed wp_users data.