CVE-2025-30562
BaseFortify
Publication date: 2025-06-17
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a high-severity SQL Injection issue in the WordPress Navigation Tree Elementor plugin (up to version 1.0.1). It allows an attacker with subscriber-level privileges to perform Blind SQL Injection, meaning they can manipulate the website's database by injecting malicious SQL commands without seeing the results directly. This improper neutralization of special elements in SQL commands can lead to unauthorized database interactions. [1]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can interact directly with your website's database, potentially leading to data theft or other malicious actions. The impact includes high confidentiality loss (data theft), and some availability loss. Since the attacker only needs subscriber-level privileges, the risk of exploitation is significant. There is currently no official fix, but a virtual patch is available to mitigate attacks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific commands or methods to detect this SQL Injection vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the virtual patch (vPatch) provided by Patchstack, which automatically blocks attacks exploiting this vulnerability until an official fix is released. Additionally, users should seek professional incident response if their sites have already been compromised. [1]