CVE-2025-28942
Published: 26 March 2025
Summary
CVE-2025-28942 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-28942 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the Trust Payments Gateway for WooCommerce plugin, specifically the trust-payments-hosted-payment-pages-integration component. This issue impacts all versions from n/a through 1.1.4 inclusive. The vulnerability was published on 2025-03-26 and carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), highlighting its critical severity due to network accessibility and lack of prerequisites.
Remote unauthenticated attackers can exploit this SQL Injection flaw over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact confidentiality violations, such as extracting sensitive data from the database, alongside low availability disruption and a changed scope that extends consequences beyond the vulnerable component.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/trust-payments-hosted-payment-pages-integration/vulnerability/wordpress-trust-payments-gateway-for-woocommerce-plugin-1-1-4-sql-injection-vulnerability?_s_id=cve provides further details on this WordPress plugin vulnerability, including mitigation guidance for affected installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8135
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a through <= 1.1.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WooCommerce plugin enables remote exploitation of web application (T1190) and direct database data extraction (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by enforcing validation of all information inputs, including those processed by the vulnerable WooCommerce plugin, to neutralize special elements in SQL commands.
Ensures timely patching and flaw remediation for the specific SQL injection vulnerability in Trust Payments Gateway for WooCommerce versions through 1.1.4.
Enables vulnerability scanning to identify SQL injection flaws like CVE-2025-28942 in plugins, facilitating proactive remediation before exploitation.