What is the CVSS score of EUVD-2025-17506?

EUVD-2025-17506 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17506?

A critical SQL injection vulnerability in WP Guppy plugin (versions through 4.3.3) allows unauthenticated attackers to extract or manipulate database content, potentially compromising customer data,…

How to fix or mitigate EUVD-2025-17506?

Within 24 hours: Audit all WordPress instances for WP Guppy installation and version; disable the plugin immediately if deployed in production. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the vulnerable plugin endpoints; conduct database integrity audit and review access logs for exploitation evidence. Within 30 days: Migrate to alternative plugins or await vendor patch; if plugin remains required, isolate affected systems behind additional network controls and implement continuous monitoring.

Wordpress Plugin EUVD-2025-17506

| CVE-2025-31920 HIGH

SQL Injection (CWE-89)

2025-06-09 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17506

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech WP Guppy allows SQL Injection. This issue affects WP Guppy: from n/a through 4.3.3.

AnalysisAI

SQL Injection vulnerability in AmentoTech WP Guppy plugin versions through 4.3.3 that allows authenticated attackers to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. With a CVSS score of 8.5 and network-based attack vector requiring only low privileges, an attacker with user-level access can exfiltrate sensitive data from the WordPress database and cause service disruption. The vulnerability's high severity is tempered by the requirement for authenticated access (PR:L), though the scope change (S:C) indicates potential lateral impact across other applications sharing the database.

Technical ContextAI

WP Guppy is a WordPress plugin (CPE context: wordpress plugin ecosystem) that fails to properly sanitize and validate user-supplied input before incorporating it into SQL queries, violating CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). This is a classic SQL Injection flaw where an attacker with WordPress user credentials can craft malicious input containing SQL metacharacters (e.g., single quotes, comment sequences, UNION operators) to break out of the intended query context and execute arbitrary database operations. The vulnerability likely exists in database query construction routines that use string concatenation rather than prepared statements or parameterized queries, which are the standard defense against SQL Injection attacks.

RemediationAI

action: Immediate Update; description: Update WP Guppy plugin to a version newer than 4.3.3 once available from AmentoTech. Check WordPress.org plugin repository or vendor site for patched releases.
action: Access Control Mitigation; description: Restrict WordPress user registration and limit plugin access to trusted administrators only via role-based capabilities until patching is possible.
action: Input Validation Hardening; description: At the application level, implement strict input validation and output encoding for all user-supplied data used in database queries within the plugin context.
action: Database-Level Protection; description: Apply principle of least privilege: ensure the WordPress database user account has minimal required permissions (read-only where possible, restricted to specific tables).
action: WAF/Monitoring; description: Deploy Web Application Firewall (WAF) rules to detect SQL Injection patterns in requests to affected plugin endpoints; enable database query logging and alerting for anomalous activity.
action: Patch Source; description: Monitor AmentoTech security advisories and WordPress.org plugin updates for patch availability; check vendor website for CVE-2025-31920 specific guidance.