What is the CVSS score of EUVD-2025-17539?

EUVD-2025-17539 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 5.3%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17539?

A critical SQL injection vulnerability in MyStyle Custom Product Designer (versions through 3.21.1) allows attackers to extract sensitive data from affected systems without authentication.

Is there a public PoC exploit available for EUVD-2025-17539?

Yes, a public proof-of-concept exploit is available for EUVD-2025-17539. Prioritise patching immediately. EPSS: 5.3%.

How to fix or mitigate EUVD-2025-17539?

Within 24 hours: Identify all instances of MyStyle Custom Product Designer in your environment and isolate affected systems from production networks if possible; notify your legal and compliance teams of potential breach risk. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the vulnerable plugin; enable database query logging and review for suspicious activity; consider disabling the custom product designer feature if business-critical functionality permits. Within 30 days: Evaluate migration to alternative plugins; establish communication with MyStyle vendor regarding patch timeline; conduct forensic analysis for evidence of exploitation.

Wordpress Plugin EUVD-2025-17539

| CVE-2025-48281 CRITICAL

SQL Injection (CWE-89)

2025-06-09 audit@patchstack.com

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17539

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer allows Blind SQL Injection. This issue affects MyStyle Custom Product Designer: from n/a through 3.21.1.

AnalysisAI

Blind SQL injection vulnerability in mystyleplatform's MyStyle Custom Product Designer that allows unauthenticated remote attackers to extract sensitive data through time-based or error-based SQL injection techniques. All versions up to and including 3.21.1 are affected. The high CVSS score of 9.3 reflects the critical nature of unauthenticated network-accessible SQL injection with high confidentiality impact, though integrity is not directly compromised and availability impact is limited.

Technical ContextAI

The vulnerability resides in the MyStyle Custom Product Designer application (CWE-89: Improper Neutralization of Special Elements used in an SQL Command), a platform used for customizable product design functionality. The root cause is insufficient input validation/parameterization in SQL query construction, allowing attackers to inject arbitrary SQL commands through user-supplied parameters. This is classified as blind SQL injection rather than error-based, meaning attackers cannot directly observe query results but can infer data through timing differences (response delays) or boolean-based inference. The affected CPE range is mystyleplatform MyStyle Custom Product Designer versions from unspecified baseline through 3.21.1, suggesting the vulnerability has existed across multiple releases without proper sanitization of database queries.

RemediationAI

Patching: Upgrade MyStyle Custom Product Designer to a version newer than 3.21.1 (specific patch version not provided in CVE description; contact mystyleplatform or monitor their security advisories); priority: Immediate Temporary Mitigation: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns (e.g., UNION, SLEEP, IF/CASE statements) in parameters passed to the Custom Product Designer endpoints; priority: High Temporary Mitigation: Restrict network access to MyStyle Custom Product Designer administrative and design endpoints using IP whitelisting or VPN requirements; priority: High Code-Level Fix: Implement parameterized queries (prepared statements) for all database interactions; use ORM frameworks with built-in SQL injection protections; priority: Critical Monitoring: Enable database query logging and audit logs for suspicious patterns (e.g., UNION-based queries, time delays, error messages leaking schema); priority: Medium