Cyber Resilience

CVE-2025-24665

Critical

Published: 27 January 2025

Published
27 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0008 23.8th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24665 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-24665 is an SQL Injection vulnerability (CWE-89) affecting the WordPress plugin Small Package Quotes – Unishippers Edition, developed by enituretechnology under the identifier small-package-quotes-unishippers-edition. The flaw stems from improper neutralization of special elements used in an SQL command, impacting all versions from n/a through 2.4.8. It carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility and potential for significant data exposure.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables high confidentiality impact, such as extracting sensitive database information, alongside low availability disruption and a changed scope that may amplify effects beyond the vulnerable component.

Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/small-package-quotes-unishippers-edition/vulnerability/wordpress-small-package-quotes-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve, which details the WordPress plugin vulnerability.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows SQL Injection.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.8.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct extraction of sensitive data from the local database (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-40315Shared CWE-89
CVE-2026-32368Shared CWE-89
CVE-2025-25257Shared CWE-89
CVE-2026-23780Shared CWE-89
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection in the WordPress plugin by requiring validation and neutralization of user inputs before incorporation into SQL commands.

SI-2 Flaw Remediation good match
prevent

Addresses the specific SQL injection flaw (CVE-2025-24665) by mandating identification, reporting, and timely remediation of vulnerabilities in system components like the Small Package Quotes plugin.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Enables proactive discovery of the unauthenticated SQL injection vulnerability through vulnerability scanning of web applications and plugins.

References