CVE-2025-30571
Published: 24 March 2025
Summary
CVE-2025-30571 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of untrusted inputs from forms before use in SQL commands, directly preventing SQL injection exploitation in the STEdb Forms plugin.
Mandates timely identification, reporting, and patching of flaws like the SQL injection vulnerability affecting STEdb Forms versions through 1.0.4.
Enables periodic vulnerability scanning to identify SQL injection issues in web plugins such as STEdb Forms, facilitating proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL Injection vulnerability directly enables unauthorized querying and access to sensitive data within the application's database.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection.This issue affects STEdb Forms: from n/a through <= 1.0.4.
Deeper analysisAI
CVE-2025-30571 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, affecting the STEdb Forms WordPress plugin developed by STEdb Corp. The issue resides in the stedb-forms component and impacts all versions from n/a through 1.0.4, where special elements are not properly neutralized in SQL commands.
The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating exploitation is possible over the network with low attack complexity by authenticated users possessing high privileges, without user interaction. Attackers can achieve high confidentiality impact, such as unauthorized access to sensitive data, alongside low availability impact, with the scope changed to affect additional resources.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/stedb-forms/vulnerability/wordpress-stedb-forms-1-0-4-sql-injection-vulnerability?_s_id=cve details the SQL Injection vulnerability specifically in the WordPress plugin stedb-forms version 1.0.4.
Details
- CWE(s)