CVE-2025-22290

Critical

Published: 16 February 2025

Published

16 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0006 19.3th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22290 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-22290, published on 2025-02-16, is an SQL Injection vulnerability (CWE-89) in the WordPress plugin LTL Freight Quotes – FreightQuote Edition by enituretechnology, with the slug ltl-freight-quotes-freightquote-edition. The flaw stems from improper neutralization of special elements used in an SQL command and affects all versions of the plugin up to and including 2.3.11. It carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility, low attack complexity, and lack of required privileges or user interaction.

Unauthenticated remote attackers can exploit this vulnerability over the network to inject and execute arbitrary SQL commands. Exploitation enables high-impact confidentiality violations, such as extracting sensitive data from the database, alongside low availability disruption, with the changed scope amplifying potential effects across the application's security context.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-freightquote-edition/vulnerability/wordpress-ltl-freight-quotes-freightquote-edition-plugin-2-3-11-sql-injection-vulnerability?_s_id=cve details the vulnerability and should be consulted for mitigation guidance.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2690

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows SQL Injection.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct extraction of sensitive data from the database (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1