Cyber Resilience

CVE-2025-47608

Critical

Published: 09 June 2025

Published
09 June 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.5776 98.2th percentile
Risk Priority 53 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47608 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-47608 is a SQL injection vulnerability (CWE-89) in the Recover abandoned cart for WooCommerce WordPress plugin by sonalsinha21. The flaw stems from improper neutralization of special elements in SQL commands and affects all versions through 2.5.

Unauthenticated remote attackers can exploit the issue over the network with low complexity, achieving a CVSS 9.3 impact that includes high confidentiality loss, limited availability degradation, and a changed scope. Successful exploitation allows arbitrary SQL queries against the database without requiring user interaction or credentials.

The Patchstack advisory at the referenced URL documents the vulnerability and is the primary public source for details; administrators should apply any available updates beyond version 2.5 or remove the plugin if no patch exists. The associated EPSS score of 0.5776 indicates substantial exploitation interest.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.5.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References