PT-2026-6886 · WordPress · Bucketlister

Ivan Cese · Published 2026-02-07 · Updated 2026-02-07 · CVE-2025-15477

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bucketlister plugin for WordPress versions up to and including 0.1.5

Description The software contains a SQL Injection issue through the category and id attributes within its shortcode. Insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query allow authenticated attackers with Contributor-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database. The vulnerable parameters are category and id.

Recommendations Update the Bucketlister plugin to a version beyond 0.1.5.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-15477

Affected Products

Bucketlister

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-15477 · Security Note
• https://plugins.trac.wordpress.org/browser/the-bucketlister/tags/0.1.5/bucketlister.php#L19 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fba36ebc-a396-4eb8-8cb6-afc50b9c974e?source=cve · Note
• https://twitter.com/CVEnew/status/2020060997700972932 · Twitter Post
• https://t.me/cveNotify/151242 · Telegram Post
• https://t.me/CVEtracker/44030 · Telegram Post