CVE-2025-22699

Critical

Published: 04 February 2025

Published

04 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0010 27.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22699 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22699 is an SQL injection vulnerability (CWE-89) in the Traveler Code WordPress plugin developed by shinetheme. The flaw stems from improper neutralization of special elements used in an SQL command within the traveler-code component. It affects all versions of the plugin from its initial release through versions prior to 3.1.2. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation across confidentiality, integrity, and availability.

Unauthenticated attackers with network access can exploit this vulnerability, though it requires high attack complexity. Successful exploitation enables arbitrary SQL execution, allowing attackers to read, modify, or delete database contents. The changed scope (S:C) amplifies the impact, potentially compromising the entire WordPress site's backend data and functionality without requiring user interaction or privileges.

Patchstack's advisory on the vulnerability, accessible via its database entry, highlights the unauthenticated arbitrary SQL execution risk specifically in Traveler Code plugin versions up to 3.1.0 and recommends updating to version 3.1.2 or later as the primary mitigation. No additional workarounds are detailed in the provided references.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2925

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing WordPress plugin directly enables T1190 Exploit Public-Facing Application for unauthenticated network-based initial access and arbitrary database operations.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1