CVE-2025-49055

Critical

Published: 22 January 2026

Published

22 January 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0037 28.9th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-49055 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-49055 is an improper neutralization of special elements used in an SQL command vulnerability (CWE-89), enabling blind SQL injection in the WP Lead Capturing Pages WordPress plugin (wp-lead-capture) developed by kamleshyadav. The flaw affects all versions of the plugin from unknown initial release through 2.5 inclusive. Published on January 22, 2026, it carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its network accessibility and high confidentiality impact.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows blind SQL injection attacks, enabling extraction of sensitive data from the underlying database (high confidentiality impact) while causing limited availability disruption (low impact) and no direct integrity compromise. The changed scope (S:C) suggests potential effects beyond the plugin's security context.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-lead-capture/vulnerability/wordpress-wp-lead-capturing-pages-plugin-2-5-sql-injection-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-4105

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Direct unauthenticated SQL injection in public-facing WordPress plugin enables remote exploitation of web app (T1190) and extraction of database contents (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0