What is the CVSS score of EUVD-2025-18521?

EUVD-2025-18521 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-18521?

A SQL injection vulnerability in WP Employee Attendance System (versions through 3.5) allows attackers to extract sensitive data from WordPress databases without authentication.

How to fix or mitigate EUVD-2025-18521?

Within 24 hours: Identify all WordPress instances running WP Employee Attendance System and document affected versions; disable the plugin if not critical to operations. Within 7 days: Contact the vendor for patch timeline and interim security guidance; implement WAF rules to block SQL injection patterns targeting the plugin. Within 30 days: Either apply the vendor patch immediately upon release or remove the plugin entirely if alternatives exist; conduct database audit for unauthorized access indicators.

Wordpress Plugin EUVD-2025-18521

| CVE-2025-28972 HIGH

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18521

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System allows Blind SQL Injection. This issue affects WP Employee Attendance System: from n/a through 3.5.

AnalysisAI

Blind SQL Injection vulnerability in Suhas Surse WP Employee Attendance System affecting versions through 3.5, allowing authenticated attackers with high privileges to extract sensitive database information. While the CVSS score of 7.6 indicates moderate-to-high severity, the attack requires administrator-level credentials and the confidentiality impact is high; however, integrity and availability impacts are limited. No current KEV designation or widespread public POC availability has been reported, though the vulnerability's nature as SQL injection makes exploitation theoretically straightforward for skilled attackers.

Technical ContextAI

This vulnerability exists in the WP Employee Attendance System WordPress plugin, a staffing/HR management tool. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating the application fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. Blind SQL Injection differs from standard SQL injection in that error messages are suppressed; attackers must infer database structure and contents through time-based delays, boolean-based responses, or out-of-band channels. The affected product is a WordPress plugin (CPE likely: cpe:2.3:a:suhas_surse:wp_employee_attendance_system:*:*:*:*:*:wordpress:*:*), which operates in the context of a WordPress database backend (typically MySQL/MariaDB). The vulnerability likely resides in database query construction within attendance-related functionality, attendance reports, or employee data retrieval endpoints.

RemediationAI

Immediate action: (1) Update WP Employee Attendance System to version 3.6 or later if available from the plugin repository; (2) If no patch is currently released, temporarily restrict administrator account access to trusted users only and audit admin account activity logs for suspicious database queries; (3) Implement WordPress security hardening—use security plugins (Wordfence, Sucuri) to monitor for SQL injection patterns in logs; (4) Code-level fix: the plugin developer must implement parameterized queries (prepared statements with placeholders) for all database operations, replacing direct query construction with parameterized methods (e.g., WordPress $wpdb->prepare() function). Recommendation: Check WordPress.org plugin repository and Suhas Surse's official channels for security advisories and patch release dates. Validate patches cryptographically before deployment in production.