What is the CVSS score of EUVD-2025-19293?

EUVD-2025-19293 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Classiera are affected by EUVD-2025-19293?

The Classiera classified-ads WordPress theme (versions 4.0.34 and earlier) contains a critical vulnerability enabling unauthenticated remote database access, exposing customer records, transaction…

How to fix or mitigate EUVD-2025-19293?

Within 24 hours, audit all WordPress installations to identify Classiera theme versions 4.0.34 and earlier and immediately disable or remove the theme to prevent exploitation. Within 7 days, implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads targeting Classiera endpoints, enforce restrictive database user permissions, and request patch availability timeline from the theme developer and Patchstack. Within 30 days, complete migration to an alternative classified-ads solution with active security updates, conduct a forensic database audit for signs of prior unauthorized access, and establish enhanced database monitoring and audit logging to detect any suspicious query patterns.

Classiera EUVD-2025-19293

| CVE-2025-52722 CRITICAL

SQL Injection (CWE-89)

2025-06-27 audit@patchstack.com

WordPress SQLi Wordpress Theme

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.6 HIGH

Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) with high DB read impact (C:H); I set S:U as injection stays within the WordPress DB authority, with minor I/A per Patchstack.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19293

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 12:15 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoinWebs Classiera allows SQL Injection. This issue affects Classiera: from n/a through 4.0.34.

AnalysisAI

SQL injection in the Classiera WordPress classified-ads theme (all versions up to and including 4.0.34) lets remote attackers inject arbitrary SQL through an unauthenticated request path, per the Patchstack advisory that reported it. Because the CVSS vector specifies PR:N and a changed scope, an attacker can reach backend database content without credentials, exposing sensitive data across the WordPress installation. No public exploit has been identified and EPSS is very low (0.05%), indicating no observed weaponization at time of analysis.

Technical ContextAI

The affected component is Classiera, a commercial classified-ads theme for the WordPress CMS (PHP/MySQL stack). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-controlled input is concatenated into a database query without adequate parameterization or sanitization, so crafted values alter the intended query structure. WordPress themes commonly expose this class of flaw through custom AJAX handlers, search/filter parameters, or listing-query endpoints that call $wpdb without prepared statements. The scope-changed CVSS metric (S:C) reflects that the injected query can reach data beyond the vulnerable component's own security authority - i.e., the shared WordPress database serving the whole site.

RemediationAI

No vendor-released patch version is identified in the available data; the disclosure covers everything up to and including 4.0.34, so administrators should monitor JoinWebs/Patchstack for a release above 4.0.34 and upgrade to it as soon as it is published (consult https://patchstack.com/database/wordpress/theme/classiera/vulnerability/wordpress-classiera-4-0-34-sql-injection-vulnerability for the fix status). Until a patched theme version is available, apply virtual patching / a WAF rule (Patchstack and comparable WordPress firewalls offer vPatch coverage for this CVE) to block SQL-injection payloads to the theme's vulnerable parameters; the trade-off is that WAF rules can be bypassed and may false-positive on legitimate search queries. As additional compensating controls, restrict the affected listing/search endpoints where feasible, enforce least-privilege on the WordPress database user to limit what a successful injection can read, and enable query logging to detect exploitation attempts - these reduce blast radius but do not close the flaw.