What is the CVSS score of EUVD-2025-18543?

EUVD-2025-18543 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-18543?

ValvePress Rankie contains a SQL injection vulnerability (CVE-2025-39486, CVSS 8.5) that permits authenticated users to execute arbitrary database queries, risking unauthorized access to sensitive…. A patch is available.

How to fix or mitigate EUVD-2025-18543?

Within 24 hours: Identify all Rankie installations in your environment and document current versions. Within 7 days: Apply the vendor-released patch to all Rankie instances, beginning with production systems; test in a non-production environment first. Within 30 days: Conduct access control review to restrict Rankie user permissions to least-privilege levels and implement database activity monitoring to detect SQL injection attempts.

Wordpress Plugin EUVD-2025-18543

| CVE-2025-39486 HIGH

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:38 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.2

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18543

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie allows SQL Injection. This issue affects Rankie: from n/a through n/a.

AnalysisAI

SQL Injection vulnerability in ValvePress Rankie that allows authenticated attackers to execute arbitrary SQL queries, potentially leading to unauthorized data disclosure and service degradation. The vulnerability affects Rankie across unspecified version ranges and requires valid user credentials to exploit. While the CVSS score of 8.5 indicates high severity, real-world exploitation risk depends on whether public proof-of-concept code exists and the prevalence of Rankie deployments in production environments.

Technical ContextAI

This vulnerability stems from CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL Injection flaw where user-supplied input is not properly sanitized before being incorporated into SQL queries. ValvePress Rankie, an SEO rank tracking and keyword monitoring solution, likely fails to use parameterized queries or proper input validation/escaping in one or more database-connected functions. The authenticated attack vector (PR:L in CVSS vector) suggests the vulnerability exists in features accessible only to logged-in users, such as keyword queries, report generation, or project management interfaces. The cross-scope impact (S:C) indicates potential for privilege escalation or lateral movement within connected systems.

RemediationAI

Immediate actions: (1) Contact ValvePress for official security patch and apply immediately upon release; (2) If patch unavailable, restrict database-level permissions for Rankie service accounts to least-privilege principle (select-only on non-sensitive tables where possible); (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads (common patterns: UNION, OR 1=1, --); (4) Monitor database logs for suspicious query patterns or failed SQL statements from Rankie processes; (5) Review access logs to identify any exploitation attempts; (6) Consider temporary disabling of affected features if they can be isolated. Longer-term: upgrade to patched version when available, implement parameterized queries/prepared statements in custom integrations, and conduct code review of Rankie's data layer.