CVE-2025-24669
Published: 24 January 2025
Summary
CVE-2025-24669 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation and neutralization of special elements in user inputs used in SQL commands within the SERPed.net plugin.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw affecting SERPed.net versions through 4.4.
Vulnerability scanning detects the SQL injection vulnerability in the SERPed.net plugin, enabling remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the public-facing WordPress plugin enables remote exploitation of the application (T1190) and directly supports privilege escalation with changed scope (T1068) as described in the CVSS impacts.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.
Deeper analysisAI
CVE-2025-24669 is an improper neutralization of special elements used in an SQL command, classified as an SQL Injection vulnerability (CWE-89), affecting the SERPed.net WordPress plugin, also referred to as serped-net. This issue impacts all versions of the plugin from unknown initial release through version 4.4 inclusive.
The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating it is exploitable remotely over the network with low attack complexity and no user interaction required. Exploitation requires low privileges, such as those of a subscribed or contributor-level WordPress user. Successful attacks enable high-impact confidentiality violations, such as unauthorized data access, low-impact availability disruption, and privilege escalation across a changed scope affecting other system components.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/serped-net/vulnerability/wordpress-serped-net-plugin-4-4-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)