What is the CVSS score of CVE-2025-68496?

CVE-2025-68496 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Syed Balkhi User Feedback are affected by CVE-2025-68496?

CVE-2025-68496 is a critical unauthenticated SQL injection vulnerability in the User Feedback WordPress plugin (versions ≤1.10.0) that allows attackers to extract sensitive database contents, modify…

How to fix or mitigate CVE-2025-68496?

Within 24 hours: Audit all WordPress installations for User Feedback plugin presence using `wp plugin list` or admin console; immediately deactivate and remove the plugin if found. Within 7 days: Identify and implement alternative feedback mechanisms that are patched and maintained; verify no malicious database modifications occurred using WordPress audit logs and database backups. Within 30 days: Establish a plugin update management policy requiring prompt evaluation of security advisories; consider using WordPress security plugins with automated vulnerability scanning (e.g., Wordfence, Sucuri) to detect similar exposures in other plugins.

Syed Balkhi User Feedback CVE-2025-68496

HIGH

SQL Injection (CWE-89)

2025-12-24 audit@patchstack.com

SQLi

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 7.6 (HIGH)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.

AnalysisAI

Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.