CVE-2025-47608
Published: 09 June 2025
Summary
CVE-2025-47608 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-47608 is a SQL injection vulnerability (CWE-89) in the Recover abandoned cart for WooCommerce WordPress plugin by sonalsinha21. The flaw stems from improper neutralization of special elements in SQL commands and affects all versions through 2.5.
Unauthenticated remote attackers can exploit the issue over the network with low complexity, achieving a CVSS 9.3 impact that includes high confidentiality loss, limited availability degradation, and a changed scope. Successful exploitation allows arbitrary SQL queries against the database without requiring user interaction or credentials.
The Patchstack advisory at the referenced URL documents the vulnerability and is the primary public source for details; administrators should apply any available updates beyond version 2.5 or remove the plugin if no patch exists. The associated EPSS score of 0.5776 indicates substantial exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17522
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.