CVE-2025-67945

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67945", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T10:00:06.384Z", "datePublished": "2026-01-22T16:51:54.311Z", "dateUpdated": "2026-04-28T16:14:24.292Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woo-mailerlite", "product": "MailerLite \u2013 WooCommerce integration", "vendor": "MailerLite", "versions": [{"changes": [{"at": "3.1.3", "status": "unaffected"}], "lessThanOrEqual": "3.1.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "NumeX | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:21:25.118Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite \u2013 WooCommerce integration woo-mailerlite allows SQL Injection.<p>This issue affects MailerLite \u2013 WooCommerce integration: from n/a through <= 3.1.2.</p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite \u2013 WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite \u2013 WooCommerce integration: from n/a through <= 3.1.2."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:24.292Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woo-mailerlite/vulnerability/wordpress-mailerlite-woocommerce-integration-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve"}], "tags": ["x_known-exploited-vulnerability"], "title": "WordPress MailerLite \u2013 WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T16:18:31.513019Z", "id": "CVE-2025-67945", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T18:07:00.419Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67945", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T16:18:31.513019Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:18:07.168Z"}}], "cna": {"tags": ["x_known-exploited-vulnerability"], "title": "WordPress MailerLite \u2013 WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "NumeX | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MailerLite", "product": "MailerLite \u2013 WooCommerce integration", "versions": [{"status": "affected", "changes": [{"at": "3.1.3", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.2"}], "packageName": "woo-mailerlite", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:21:25.118Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/woo-mailerlite/vulnerability/wordpress-mailerlite-woocommerce-integration-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite \u2013 WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite \u2013 WooCommerce integration: from n/a through <= 3.1.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite \u2013 WooCommerce integration woo-mailerlite allows SQL Injection.<p>This issue affects MailerLite \u2013 WooCommerce integration: from n/a through <= 3.1.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:13:55.304Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67945", "state": "PUBLISHED", "dateUpdated": "2026-04-27T18:07:00.419Z", "dateReserved": "2025-12-15T10:00:06.384Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-22T16:51:54.311Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woo-mailerlite", "product": "MailerLite \u2013 WooCommerce integration", "vendor": "MailerLite", "versions": [{"changes": [{"at": "3.1.3", "status": "unaffected"}], "lessThanOrEqual": "3.1.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite \u2013 WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite \u2013 WooCommerce integration: from n/a through <= 3.1.2."}, {"lang": "es", "value": "Neutralizaci\u00f3n inadecuada de elementos especiales utilizados en un comando SQL ('inyecci\u00f3n SQL') vulnerabilidad en MailerLite MailerLite \u2013 integraci\u00f3n de WooCommerce woo-mailerlite permite la inyecci\u00f3n SQL. Este problema afecta a MailerLite \u2013 integraci\u00f3n de WooCommerce: desde n/a hasta &lt;= 3.1.2."}], "id": "CVE-2025-67945", "lastModified": "2026-06-17T09:58:18.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67945", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T16:18:31.513019Z", "version": "2.0.3"}}]}, "published": "2026-01-22T17:16:04.170", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/woo-mailerlite/vulnerability/wordpress-mailerlite-woocommerce-integration-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T18:11:38.085973+00:00", "value": {"mitigation_remediation": ["Upgrade MailerLite \u2013 WooCommerce integration to a version newer than 3.1.2 as soon as possible.", "If an upgrade cannot be performed immediately, deactivate or uninstall the plugin to eliminate the vulnerability.", "Restrict the database user account used by WordPress to the minimum privileges required for normal operation, reducing the impact if an injection does occur.", "Consider implementing a web application firewall or input filtering to block suspicious SQL injection payloads targeting the plugin\u2019s endpoints."], "summary": {"action": "Immediate Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "MailerLite \u2013 WooCommerce integration plugin for WordPress; versions up to and including 3.1.2 are vulnerable; earlier versions prior to the fix are also considered susceptible.", "description_and_impact": "The MailerLite \u2013 WooCommerce integration plugin for WordPress contains an SQL injection flaw caused by improper neutralization of special characters in SQL statements. An attacker who can supply input to the plugin\u2019s WooCommerce integration functions can inject arbitrary SQL, allowing read, modify, or delete operations on the database. This could compromise data confidentiality, integrity, and potentially availability if the database is affected.", "risk_and_exploitability": "The CVSS score of 9.3 reflects a high severity level. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is currently not listed in CISA\u2019s KEV catalog. The likely attack vector is a web request to the plugin\u2019s integration endpoints that accept user input; the presence or absence of authentication requirements is not explicitly stated. Exploitation could lead to arbitrary SQL execution against the database, potentially exposing sensitive data and disrupting application functionality."}}}}, "created": "2026-01-23T16:31:27.565458+00:00", "updated": "2026-04-28T18:15:37.369342+00:00", "vendors": ["mailerlite", "mailerlite$PRODUCT$mailerlite", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}