PT-2025-48642 · WordPress · Db-Access

Yousof Nahya · Published 2025-12-02 · Updated 2026-01-30 · CVE-2025-13000

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions db-access WordPress plugin versions through 0.8.7

Description The db-access WordPress plugin does not have proper authorization for an AJAX action. This allows authenticated users, including those with subscriber privileges, to potentially execute SQL injection attacks. The vulnerability allows any authenticated user to perform SQLi attacks.

Recommendations Update the db-access WordPress plugin to a version later than 0.8.7.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13000

Affected Products

Db-Access

References · 8

• 🔥 https://wpscan.com/vulnerability/aec53f87-6500-4c8a-925a-146be61bbabf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13000 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13000 · Vendor Advisory
• https://twitter.com/CVEnew/status/1995741118709875147 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995745305657025013 · Twitter Post
• https://t.me/cveNotify/150442 · Telegram Post
• https://t.me/cveNotify/144499 · Telegram Post
• https://t.me/CVEtracker/38638 · Telegram Post