CVE-2025-69305
Awaiting Analysis Awaiting Analysis - Queue
Blind SQL Injection in TeconceTheme Crete Core

Publication date: 2026-02-20

Last updated on: 2026-02-24

Assigner: Patchstack

Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-20
Last Modified
2026-02-24
Generated
2026-06-16
AI Q&A
2026-02-20
EPSS Evaluated
2026-06-14
NVD
CVE-2025-69305
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
teconce_theme crete_core From 1.0.0 (inc) to 1.4.3 (inc)
teconcedesign crete_core to 1.4.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69305 is a high-priority SQL Injection vulnerability in the WordPress Crete Core Plugin versions up to and including 1.4.3.

This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries directly on the database.

It is classified as a Blind SQL Injection issue, meaning attackers can manipulate database queries without seeing the direct output.

The vulnerability falls under the OWASP Top 10 category A3: Injection.

Impact Analysis

This vulnerability can lead to serious impacts including unauthorized data theft and other malicious actions.

Because attackers can execute arbitrary SQL commands without authentication, they may manipulate or extract sensitive information from the database.

The vulnerability has a critical CVSS severity score of 9.3, indicating a high likelihood of exploitation and severe consequences.

Compliance Impact

I don't know

Detection Guidance

CVE-2025-69305 is a Blind SQL Injection vulnerability in the WordPress Crete Core Plugin up to version 1.4.3 that allows unauthenticated attackers to execute arbitrary SQL queries.

While no specific detection commands are provided, typical detection methods for SQL Injection vulnerabilities include using web application security scanners or manual testing with SQL injection payloads in input fields or URL parameters related to the Crete Core plugin.

Network or system administrators can monitor for unusual database query patterns or error messages in logs that may indicate attempted exploitation.

Additionally, applying the mitigation rule provided by Patchstack can help block exploitation attempts and serve as a detection mechanism.

Mitigation Strategies

Immediate mitigation steps include applying the mitigation rule provided by Patchstack, which can block attacks exploiting this vulnerability until an official patch is released.

Users are strongly advised to implement this mitigation immediately to protect their websites running the Crete Core plugin versions up to 1.4.3.

Since no official patch is available as of the publication date, applying this mitigation is the best immediate defense.

Additionally, monitoring and restricting access to the affected plugin and reviewing database logs for suspicious activity can help reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart