CVE-2025-30791
Published: 27 March 2025
Summary
CVE-2025-30791 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked in the top 33.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection by requiring validation of user inputs to neutralize special elements before use in SQL commands.
Requires timely patching and remediation of the specific flaw in the Cart tracking for WooCommerce plugin versions <=1.0.16.
Enables proactive identification of the SQL injection vulnerability through regular vulnerability scanning of plugins and web applications.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL Injection vulnerability (CWE-89) directly enables arbitrary database queries, facilitating unauthorized data access from the application's database (high confidentiality impact).
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.16.
Deeper analysisAI
CVE-2025-30791 is an SQL Injection vulnerability (CWE-89) stemming from improper neutralization of special elements used in an SQL command. It affects the Cart tracking for WooCommerce plugin (cart-tracking-for-woocommerce) developed by wpdever, impacting all versions from n/a through 1.0.16.
The vulnerability can be exploited over the network (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H) and no user interaction (UI:N). Attackers can achieve high confidentiality impact (C:H) such as unauthorized data access, low availability impact (A:L), and scope change (S:C), resulting in a CVSS v3.1 base score of 7.6.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/cart-tracking-for-woocommerce/vulnerability/wordpress-cart-tracking-for-woocommerce-plugin-1-0-16-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)