Cyber Posture

CVE-2025-24665

Critical

Published: 27 January 2025

Published
27 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0008 23.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24665 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates SQL injection in the WordPress plugin by requiring validation and neutralization of user inputs before incorporation into SQL commands.

prevent

Addresses the specific SQL injection flaw (CVE-2025-24665) by mandating identification, reporting, and timely remediation of vulnerabilities in system components like the Small Package Quotes plugin.

detect

Enables proactive discovery of the unauthenticated SQL injection vulnerability through vulnerability scanning of web applications and plugins.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct extraction of sensitive data from the local database (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows SQL Injection.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.8.

Deeper analysisAI

CVE-2025-24665 is an SQL Injection vulnerability (CWE-89) affecting the WordPress plugin Small Package Quotes – Unishippers Edition, developed by enituretechnology under the identifier small-package-quotes-unishippers-edition. The flaw stems from improper neutralization of special elements used in an SQL command, impacting all versions from n/a through 2.4.8. It carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility and potential for significant data exposure.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high confidentiality impact, such as extracting sensitive database information, alongside low availability disruption and a changed scope that may amplify effects beyond the vulnerable component.

Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/small-package-quotes-unishippers-edition/vulnerability/wordpress-small-package-quotes-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve, which details the WordPress plugin vulnerability.

Details

CWE(s)

CVEs Like This One

CVE-2026-32368Shared CWE-89
CVE-2026-40315Shared CWE-89
CVE-2025-25257Shared CWE-89
CVE-2026-23780Shared CWE-89
CVE-2026-3180Shared CWE-89
CVE-2025-1872Shared CWE-89
CVE-2026-32458Shared CWE-89
CVE-2026-24494Shared CWE-89
CVE-2025-26875Shared CWE-89
CVE-2026-26263Shared CWE-89

References