What is the CVSS score of CVE-2025-59557?

CVE-2025-59557 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Learts Addons CVE-2025-59557

Q: Which versions of Learts Addons are affected by CVE-2025-59557?

SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands.

CRITICAL

SQL Injection (CWE-89)

2025-10-22 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Network-accessible, low complexity, no privileges or user interaction; scope changed; high confidentiality impact, no integrity, low availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:35 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.

AnalysisAI

SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).

Technical ContextAI

The flaw resides in the Learts Addons WordPress plugin, likely stemming from insufficient sanitization of user-supplied input before incorporating it into SQL queries (CWE-89). As a web plugin, it operates within the WordPress environment, potentially exposing database operations through publicly accessible endpoints (e.g., AJAX handlers or REST API routes). An attacker can inject special SQL elements, causing the backend database to execute unintended commands with the scope change (S:C) implying impact beyond the vulnerable component itself.

Affected ProductsAI

ThemeMove Learts Addons WordPress plugin versions n/a through less than 1.7.5. The vendor-released fix is version 1.7.5. Reference: Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/learts-addons/vulnerability/wordpress-learts-addons-plugin-1-7-5-sql-injection-vulnerability?_s_id=cve.

RemediationAI

Immediately update Learts Addons to version 1.7.5 or higher. The Patchstack advisory (see URL) documents the fix. If immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. No other official workarounds are disclosed; web application firewall rules targeting SQL injection may provide partial mitigation but are not guaranteed.