What is the CVSS score of CVE-2025-52822?

CVE-2025-52822 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-52822?

A high-severity SQL injection vulnerability exists in WP Roadmap plugin (versions through 2.1.3) that could allow attackers to access, modify, or delete sensitive database information without a patch…

How to fix or mitigate CVE-2025-52822?

Within 24 hours: Inventory all WordPress installations running WP Roadmap and identify affected versions; implement WAF rules to block SQL injection patterns targeting the plugin. Within 7 days: Disable the WP Roadmap plugin if non-critical, or restrict access to trusted administrators only via network segmentation and IP whitelisting; apply principle of least privilege to database accounts. Within 30 days: Monitor vendor channels for patch release; prepare testing environment for patch deployment; conduct database integrity audit for unauthorized access indicators.

Wordpress Plugin CVE-2025-52822

EUVD-2025-28473 HIGH

SQL Injection (CWE-89)

2025-06-20 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28473

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WP Roadmap allows SQL Injection. This issue affects WP Roadmap: from n/a through 2.1.3.

AnalysisAI

CVE-2025-52822 is an SQL injection vulnerability in Iqonic Design's WP Roadmap WordPress plugin (versions up to 2.1.3) that allows authenticated attackers to execute arbitrary SQL commands. An attacker with user-level privileges can exploit this via network access without user interaction to read sensitive database contents and cause denial of service. The vulnerability has not been confirmed as actively exploited in the wild, but the high CVSS score (8.5) and low attack complexity indicate this should be treated as a priority for affected WordPress installations.

Technical ContextAI

The vulnerability exists in the WP Roadmap plugin for WordPress (CPE: wp:wp-roadmap), a roadmap/project timeline management plugin. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input is not properly sanitized or parameterized before being incorporated into SQL queries. WordPress plugins commonly interact with the WordPress database via wpdb functions; this vulnerability suggests the plugin constructs dynamic SQL queries using string concatenation rather than prepared statements with placeholders. The affected versions range from the initial release through version 2.1.3, suggesting the vulnerability was introduced early in the plugin's development and persisted through multiple releases.