What is the CVSS score of CVE-2025-67517?

CVE-2025-67517 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of ArtPlacer Widget are affected by CVE-2025-67517?

The ArtPlacer Widget WordPress plugin (versions through 2.22.9.2) contains a SQL injection vulnerability that allows authenticated low-privilege users to extract sensitive data from the entire…

How to fix or mitigate CVE-2025-67517?

Within 24 hours, identify all WordPress installations running ArtPlacer Widget versions through 2.22.9.2 and audit low-privilege user account permissions; for critical systems, disable the plugin immediately to eliminate the attack vector. Within 7 days, restrict the creation of new low-privilege accounts on affected installations, implement database access logging and query monitoring for anomalies, and subscribe to vendor notifications for security updates. Within 30 days, plan a permanent remediation strategy by either replacing ArtPlacer Widget with an alternative plugin solution or establishing a vendor contact to expedite patch availability; for high-risk installations, conduct a database access control audit and consider deploying a Web Application Firewall (WAF) rule set to restrict unauthorized SQL injection attempts.

ArtPlacer Widget CVE-2025-67517

HIGH

SQL Injection (CWE-89)

2025-12-09 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

PR:L confirmed by plugin requiring an active WordPress session; S:C reflects shared WordPress DB scope; I:N retained as Blind SQLi read-path only.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:39 vuln.today

CVE Published

Dec 09, 2025 - 16:18 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Blind SQL Injection.This issue affects ArtPlacer Widget: from n/a through <= 2.22.9.2.

AnalysisAI

Blind SQL injection in the ArtPlacer Widget WordPress plugin (versions through 2.22.9.2) allows an authenticated low-privilege attacker to extract database contents via crafted requests to a vulnerable endpoint. The vulnerability carries a scope-changed CVSS rating because the WordPress database is shared across plugins and core, meaning successful exploitation can expose credentials, user data, and content belonging to other installed components - not just the ArtPlacer plugin itself. No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score (0.06%, 19th percentile) reflects minimal current attacker interest.

Technical ContextAI

ArtPlacer Widget is a WordPress plugin (artplacer-widget) used to embed art gallery display widgets on WordPress sites. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements in an SQL Command), the root cause of SQL injection, meaning user-controlled input is incorporated into a database query without adequate parameterization or escaping. The Blind variant indicates output is not directly returned to the attacker - instead, data is inferred through boolean-conditional responses or time-based delays (e.g., SLEEP() calls), making automated tooling like sqlmap necessary for practical exploitation. Because WordPress runs all plugins against a single shared MySQL/MariaDB database schema, a scope change (S:C in the CVSS vector) is appropriate: a successful injection in the plugin can reach wp_users password hashes, wp_options secret keys, and data owned by entirely separate plugins.

Affected ProductsAI

The ArtPlacer Widget WordPress plugin by artplacer is affected in all versions from an unspecified baseline through and including version 2.22.9.2. The vulnerability was reported via the Patchstack database and no CPE string was formally assigned in the available data. No upper-bound patch version was confirmed in the provided references; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/artplacer-widget/vulnerability/wordpress-artplacer-widget-plugin-2-22-9-2-sql-injection-vulnerability should be consulted for the current fixed release.

RemediationAI

The primary remediation is to update the ArtPlacer Widget plugin to a version released after 2.22.9.2; the exact fixed version was not confirmed in the available data, so administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/artplacer-widget/vulnerability/wordpress-artplacer-widget-plugin-2-22-9-2-sql-injection-vulnerability for the current patched release. If no patch is immediately available or applicable, a compensating control is to disable or deactivate the ArtPlacer Widget plugin entirely until patching is possible - this eliminates the attack surface with the trade-off of losing art-display functionality. Additionally, restricting WordPress user registration to prevent untrusted low-privilege account creation limits the PR:L exploitation path, since the attacker must possess a valid login. Web application firewall (WAF) rules targeting SQL keywords in plugin-related request parameters (e.g., Patchstack's virtual patching or Wordfence) can provide temporary coverage, though bypass is possible against naive pattern-matching rules.