EUVD-2025-17533Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments allows SQL Injection. This issue affects Multi CryptoCurrency Payments: from n/a through 2.0.3.
AnalysisAI
Critical SQL injection vulnerability in Alex Zaytseff's Multi CryptoCurrency Payments plugin (versions up to 2.0.3) that allows unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 9.3 with network-based attack vector and no privileges required, enabling attackers to extract sensitive data including cryptocurrency transaction records, user credentials, and payment information. The high CVSS combined with an unauthenticated, low-complexity attack vector suggests this is a high-priority vulnerability with significant real-world exploitation risk.
Technical ContextAI
The vulnerability exists in the Multi CryptoCurrency Payments plugin (CPE identifiers: software for processing cryptocurrency transactions through WordPress/e-commerce platforms). The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Command), indicating that user-supplied input is not properly sanitized before being incorporated into SQL queries. This is a classical SQL injection flaw where an attacker can manipulate query logic by injecting SQL metacharacters and commands. The affected product processes cryptocurrency payment data, making it particularly attractive as the injected queries could access wallet addresses, transaction hashes, user payment history, and potentially stored private keys or sensitive authentication tokens.
RemediationAI
Upgrade to version 2.0.4 or later (assuming this version or higher contains the fix; verify with vendor); priority: IMMEDIATE Vendor Advisory: Check Alex Zaytseff's official security advisory and plugin repository for patched versions. Update immediately upon availability.; details: Recommend contacting the vendor directly if patches are not yet released Workaround (Temporary): If patching is not immediately possible: (1) Disable the Multi CryptoCurrency Payments plugin; (2) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in requests to the plugin's endpoints; (3) Apply strict input validation at the WAF level for cryptocurrency payment forms; details: These are temporary mitigations only and do not address the underlying vulnerability Detection: Monitor logs for suspicious SQL syntax in plugin requests (e.g., UNION SELECT, OR 1=1, comment sequences); check transaction logs and payment records for unauthorized access Incident Response: If the plugin was running on production systems prior to patching, conduct forensic analysis to determine if cryptocurrency wallets, user data, or payment information were accessed or exfiltrated
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today