CVE-2025-30810
Published: 27 March 2025
Summary
CVE-2025-30810 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of information inputs using defined tools and procedures, directly preventing blind SQL injection by neutralizing special elements before they reach SQL commands in the WordPress plugin.
SI-2 mandates identification, reporting, and correction of system flaws, directly mitigating this CVE through timely patching of the vulnerable wp-leads-builder-any-crm plugin up to version 3.0.1.
RA-5 requires vulnerability scanning of systems and applications, enabling detection of SQL injection flaws like CVE-2025-30810 to facilitate remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin directly enables remote exploitation of the application for initial access and data extraction.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Blind SQL Injection.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.0.1.
Deeper analysisAI
CVE-2025-30810 is an SQL injection vulnerability, classified as improper neutralization of special elements used in an SQL command (CWE-89), enabling blind SQL injection in the WordPress plugin "Lead Form Data Collection to CRM" (wp-leads-builder-any-crm) developed by Smackcoders Inc. The flaw affects all versions up to and including 3.0.1, with no lower bound specified.
The vulnerability can be exploited by a low-privileged user (PR:L) remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation yields high confidentiality impact (C:H), allowing potential extraction of sensitive data through blind SQL injection techniques, alongside low availability impact (A:L) and no integrity impact (I:N), within a scoped attack surface (S:C). The CVSS v3.1 base score is 8.5.
Patchstack advisories document the issue and provide vulnerability details at https://patchstack.com/database/Wordpress/Plugin/wp-leads-builder-any-crm/vulnerability/wordpress-lead-form-data-collection-to-crm-plugin-3-0-1-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)