CVE-2025-24665
Published: 27 January 2025
Summary
CVE-2025-24665 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection in the WordPress plugin by requiring validation and neutralization of user inputs before incorporation into SQL commands.
Addresses the specific SQL injection flaw (CVE-2025-24665) by mandating identification, reporting, and timely remediation of vulnerabilities in system components like the Small Package Quotes plugin.
Enables proactive discovery of the unauthenticated SQL injection vulnerability through vulnerability scanning of web applications and plugins.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct extraction of sensitive data from the local database (T1005).
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows SQL Injection.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.8.
Deeper analysisAI
CVE-2025-24665 is an SQL Injection vulnerability (CWE-89) affecting the WordPress plugin Small Package Quotes – Unishippers Edition, developed by enituretechnology under the identifier small-package-quotes-unishippers-edition. The flaw stems from improper neutralization of special elements used in an SQL command, impacting all versions from n/a through 2.4.8. It carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility and potential for significant data exposure.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high confidentiality impact, such as extracting sensitive database information, alongside low availability disruption and a changed scope that may amplify effects beyond the vulnerable component.
Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/small-package-quotes-unishippers-edition/vulnerability/wordpress-small-package-quotes-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve, which details the WordPress plugin vulnerability.
Details
- CWE(s)