CVE-2025-22350
Published: 07 January 2025
Summary
CVE-2025-22350 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of all inputs used in SQL commands within the vulnerable WordPress plugin.
SI-2 mandates timely patching and flaw remediation for the specific SQL injection vulnerability in Ultimate Learning Pro versions through 3.9.
SC-7 boundary protection, such as web application firewalls, blocks or detects SQL injection payloads targeting the plugin over the network.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a publicly accessible WordPress plugin directly enables exploitation of a public-facing web application for unauthorized database data access.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.
Deeper analysisAI
CVE-2025-22350 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the WordPress plugin Ultimate Learning Pro by WpIndeed. The issue impacts all versions from n/a through 3.9 and was published on 2025-01-07T17:15:33.093. It carries a CVSS v3.1 base score of 7.6, reflecting network accessibility, low attack complexity, high privileges required, no user interaction, changed scope, high confidentiality impact, no integrity impact, and low availability impact.
High-privileged remote users (PR:H) can exploit this SQL injection vulnerability over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). Exploitation enables attackers to achieve high confidentiality impact (C:H), such as extracting sensitive data from the database, alongside low availability disruption (A:L), due to the changed scope (S:C).
Mitigation details are provided in the advisory from Patchstack at https://patchstack.com/database/wordpress/plugin/indeed-learning-pro/vulnerability/wordpress-indeed-ultimate-learning-pro-plugin-3-9-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)