Cyber Resilience

CVE-2025-22523

Critical

Published: 28 March 2025

Published
28 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0012 29.9th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22523 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-22523 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, that enables Blind SQL Injection in the Schedule plugin for WordPress. The vulnerability affects the scheduler Schedule component in versions from n/a through 1.0.0 inclusive. It was published on 2025-03-28 with a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction. By injecting malicious SQL payloads into affected inputs, attackers can perform blind SQL injection to infer and extract sensitive data from the underlying database, achieving high confidentiality impact. The changed scope and low availability impact suggest potential disruption limited to the database layer.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/schedule/vulnerability/wordpress-schedule-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scheduler Schedule schedule allows Blind SQL Injection.This issue affects Schedule: from n/a through <= 1.0.0.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes an unauthenticated blind SQL injection vulnerability in a public-facing WordPress plugin, directly enabling remote exploitation of the web application to extract sensitive database data.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of user inputs to the scheduler Schedule plugin to neutralize special elements in SQL commands, preventing blind SQL injection exploitation.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of flaws like the SQL injection vulnerability in Schedule plugin versions through 1.0.0.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning of web applications and plugins to identify SQL injection flaws such as CVE-2025-22523 prior to exploitation.

References