CVE-2025-22710
Published: 21 January 2025
Summary
CVE-2025-22710 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation and neutralization of special elements in user inputs before incorporation into SQL commands.
SI-2 ensures timely patching and remediation of the specific Blind SQL Injection flaw in the Smart Manager plugin versions through 8.52.0.
RA-5 requires vulnerability scanning that identifies SQL injection vulnerabilities like CVE-2025-22710 in WordPress plugins, enabling remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The blind SQL injection vulnerability directly enables extraction of sensitive data from the underlying database, mapping to collection from information repositories specifically databases.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.
Deeper analysisAI
CVE-2025-22710 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the storeapps Smart Manager plugin for WordPress, specifically the smart-manager-for-wp-e-commerce component. This issue affects Smart Manager versions from n/a through 8.52.0 and is associated with CWE-89.
The vulnerability has a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating it can be exploited remotely over the network with low attack complexity by high-privileged users without requiring user interaction. Exploitation changes scope and primarily impacts confidentiality at a high level, with low availability impact and no integrity impact, allowing attackers to extract sensitive data from the underlying database through blind SQL injection techniques.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/smart-manager-for-wp-e-commerce/vulnerability/wordpress-smart-manager-plugin-8-52-0-sql-injection-vulnerability?_s_id=cve provides details on this WordPress Smart Manager plugin 8.52.0 SQL injection vulnerability, including mitigation guidance.
Details
- CWE(s)