What is the CVSS score of CVE-2025-68561?

CVE-2025-68561 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Ruben Garcia AutomatorWP CVE-2025-68561

Q: Which versions of Ruben Garcia AutomatorWP are affected by CVE-2025-68561?

SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands.

HIGH

SQL Injection (CWE-89)

2025-12-23 audit@patchstack.com

SQLi

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.6 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 23, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.

AnalysisAI

SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands. The vulnerability exists in the plugin's database query handling where user-supplied input is not properly sanitized before being used in SQL statements. While EPSS scoring indicates low exploitation probability (0.04th percentile), the SQL injection vector represents a critical capability if exploited, potentially enabling data exfiltration, modification, or deletion from the affected WordPress database.

Technical ContextAI

AutomatorWP is a WordPress automation plugin that enables users to create complex automation workflows. The vulnerability stems from CWE-89 (SQL Injection), a classic input validation failure where user-controlled data reaches database query construction without proper parameterization or escaping. This typically occurs when the plugin builds dynamic SQL queries using string concatenation or inadequate prepared statement implementation. WordPress plugins are executed within the wp-content/plugins directory and interact directly with the wpdb database abstraction layer; improper use of this API (such as direct query concatenation instead of parameterized queries with $wpdb->prepare()) creates SQLi exposure. The affected plugin versions through 5.2.4 contain this flaw in their automation rule processing or trigger evaluation logic.

Affected ProductsAI

AutomatorWP WordPress plugin versions from an unspecified baseline through and including version 5.2.4 are affected. The plugin is distributed via WordPress.org plugin repository and installed in the wp-content/plugins/automatorwp directory. Vulnerability data from Patchstack indicates the flaw is present in all versions up to and including 5.2.4, though the starting version of vulnerability introduction is not explicitly documented.

RemediationAI

Site administrators running AutomatorWP should immediately update the plugin to version 5.2.5 or later, which contains the SQL injection fix. Update the plugin via the WordPress admin dashboard (Plugins > Updates) or via WordPress CLI using wp plugin update automatorwp. If a patched version is not yet available, temporarily disable the AutomatorWP plugin and review active automation rules for suspicious configurations. Site owners should also audit database access logs and user accounts with plugin management capabilities to detect prior unauthorized access. The vulnerability details and remediation guidance are available on the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/automatorwp/vulnerability/wordpress-automatorwp-plugin-5-2-4-sql-injection-vulnerability.