Cyber Resilience

CVE-2025-9697

Critical

Published: 02 October 2025

Published
02 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9697 is a critical-severity an unspecified weakness vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-9697 is a SQL injection vulnerability affecting the Ajax WooSearch WordPress plugin through version 1.0.0. The flaw arises because the plugin does not properly sanitize and escape a parameter before incorporating it into a SQL statement via an AJAX action that is accessible to unauthenticated users.

The vulnerability can be exploited by unauthenticated attackers over the network with low complexity and no user interaction required, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing attackers to extract sensitive data from the database, modify records, or disrupt services.

Mitigation details are available in advisories from WPScan, referenced at https://wpscan.com/vulnerability/38939152-e54e-4f8f-996b-592de195570d/.

EU & UK References

Vulnerability details

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

Unauthenticated SQL injection in a public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) and facilitates T1213.006 (Data from Information Repositories: Databases) via malicious SQL payloads for data extraction, modification, or deletion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like the SQL injection vulnerability in the Ajax WooSearch plugin.

SI-10 Information Input Validation good match
prevent

Mandates validation of unsanitized parameters before use in SQL statements to directly prevent SQL injection exploits via the vulnerable AJAX action.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection mechanisms such as web application firewalls can inspect and block SQL injection attempts targeting the unauthenticated AJAX endpoint.

References