CVE-2025-48281
Published: 09 June 2025
Summary
CVE-2025-48281 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-48281 is an SQL injection flaw (CWE-89) caused by improper neutralization of special elements in an SQL command. It affects the MyStyle Custom Product Designer WordPress plugin from mystyleplatform, with all versions through 3.21.1 impacted and enabling blind SQL injection.
Unauthenticated remote attackers can exploit the issue over the network without user interaction, achieving high confidentiality impact along with limited availability effects as reflected in its CVSS 3.1 score of 9.3.
The Patchstack advisory at the referenced URL documents the vulnerability in the mystyle-custom-product-designer plugin and serves as the primary source for details on affected code paths.
EPSS for this CVE rose from a low baseline to a peak of 0.0666, indicating that exploitation interest emerged after disclosure and that the issue warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-17539
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.