PT-2025-40487 · WordPress · Blappsta Mobile App Plugin

Jarno Vos · Published 2025-10-03 · Updated 2025-10-08 · CVE-2025-9200

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blappsta Mobile App Plugin versions prior to 0.8.8.9

Description The Blappsta Mobile App Plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and query preparation. Specifically, the nh ynaa comments() function lacks sufficient escaping of user-supplied parameters, allowing attackers to inject malicious SQL queries. This can enable unauthenticated attackers to extract sensitive information from the database by appending additional SQL queries to existing ones.

Recommendations Update to version 0.8.8.9 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-9200

Affected Products

Blappsta Mobile App Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9200 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9169931c-a679-4801-b33b-08c4f464dc43?source=cve · Note
• https://twitter.com/CVEnew/status/1974076257810674125 · Twitter Post
• https://wordpress.org/plugins/yournewsapp · Note
• https://twitter.com/VulmonFeeds/status/1974157183840358885 · Twitter Post
• https://twitter.com/cracbot/status/1975878897553043890 · Twitter Post