What is the CVSS score of EUVD-2025-18550?

EUVD-2025-18550 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-18550?

A SQL injection vulnerability in the wpdistillery Navigation Tree Elementor plugin (versions through 1.0.1) allows attackers to extract sensitive database information without authentication.

How to fix or mitigate EUVD-2025-18550?

Within 24 hours: audit all WordPress installations for Navigation Tree Elementor plugin presence and version; disable the plugin immediately on affected systems. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the plugin; isolate affected WordPress environments from production networks if feasible. Within 30 days: migrate to alternative navigation solutions; contact vendor for patch timeline; conduct database security audit to detect unauthorized access.

Wordpress Plugin EUVD-2025-18550

| CVE-2025-30562 HIGH

SQL Injection (CWE-89)

2025-06-17 audit@patchstack.com

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 10:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18550

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor allows Blind SQL Injection. This issue affects Navigation Tree Elementor: from n/a through 1.0.1.

AnalysisAI

A blind SQL injection vulnerability exists in wpdistillery Navigation Tree Elementor plugin (versions up to 1.0.1) that allows authenticated users to extract sensitive database information through specially crafted input. The vulnerability requires user authentication but operates over the network with low attack complexity, enabling attackers with WordPress user accounts to enumerate and exfiltrate data without direct visibility of query results. No publicly disclosed proof-of-concept or active exploitation in KEV has been confirmed at this time, though the 8.5 CVSS score and SQL injection nature warrant immediate patching.

Technical ContextAI

This vulnerability exploits improper input sanitization in the Navigation Tree Elementor WordPress plugin (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The plugin likely constructs SQL queries using user-supplied input without adequate parameterized query protection or input validation. Blind SQL injection attacks differ from standard SQL injection by not returning query results directly; instead, attackers infer database content through response-time analysis, boolean-based inference, or error-based channels. The vulnerability affects the Elementor page builder ecosystem, a widely-deployed WordPress plugin framework. The attack vector is network-based (CVSS:3.1/AV:N), requiring authentication (PR:L), indicating WordPress user roles can trigger exploitation. The scope change (S:C) suggests the vulnerability impacts resources beyond the vulnerable component, potentially affecting other WordPress instances or shared database resources.

RemediationAI

Update plugin via WordPress admin dashboard or directly from wpdistillery repository. Workaround (Temporary): Use WordPress role management to remove Elementor access from lower-privilege user accounts pending patch availability. Mitigation: Deploy WAF signatures for SQL injection in WordPress plugin requests; monitor for unusual query patterns. Code-Level Fix: Vendor should audit all Navigation Tree Elementor SQL calls and apply parameterized query patterns.