What is the CVSS score of CVE-2025-52819?

CVE-2025-52819 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-52819

Q: Which versions of Wordpress Plugin are affected by CVE-2025-52819?

SQL injection vulnerability in Pakke Envíos WordPress plugin versions up to 1.0.2 allows unauthenticated attackers to execute arbitrary SQL commands through improper input neutralization.

HIGH

SQL Injection (CWE-89)

2025-07-16 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

8.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issue affects Pakke Envíos: from n/a through <= 1.0.2.

AnalysisAI

SQL injection vulnerability in Pakke Envíos WordPress plugin versions up to 1.0.2 allows unauthenticated attackers to execute arbitrary SQL commands through improper input neutralization. The vulnerability affects a widely-distributed WordPress plugin with no CVSS score available; however, EPSS data indicates low exploitation probability at 0.05%, suggesting limited real-world attack interest or technical barriers. No public exploit code or active exploitation has been confirmed.

Technical ContextAI

The vulnerability exists in Pakke Envíos (pakkemx), a WordPress plugin for shipping management, and stems from CWE-89 (SQL Injection) - the improper sanitization and escaping of user-supplied input before it is incorporated into SQL queries. WordPress plugins are server-side PHP applications that interact directly with the WordPress MySQL database; SQL injection in this context typically occurs when query parameters, form inputs, or HTTP headers are concatenated into database queries without prepared statements or parameterized queries. The affected plugin versions through 1.0.2 fail to implement proper input validation and output encoding mechanisms that would prevent malicious SQL syntax from being interpreted as commands.

Affected ProductsAI

Pakke Envíos (pakkemx) WordPress plugin is affected in versions 1.0.2 and earlier. The vulnerability was reported by audit@patchstack.com and is documented in the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/pakke/vulnerability/wordpress-pakke-envios-1-0-2-sql-injection-vulnerability?_s_id=cve). No other related products or vendor-branded variants were identified in the provided intelligence.

RemediationAI

Users of Pakke Envíos should upgrade to a patched version beyond 1.0.2 as soon as available. The primary vendor advisory is available via Patchstack (https://patchstack.com/database/Wordpress/Plugin/pakke/vulnerability/wordpress-pakke-envios-1-0-2-sql-injection-vulnerability?_s_id=cve), which should be consulted for the exact fix version number and release date. Until a patch is available, website administrators should consider disabling the Pakke Envíos plugin if it is not essential to operations, or apply Web Application Firewall rules to block SQL injection patterns in HTTP requests targeting the plugin. Additionally, regular database backups and SQL query logging should be enabled to detect any compromise.