CVE-2025-69305
Blind SQL Injection in TeconceTheme Crete Core
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| teconce_theme | crete_core | From 1.0.0 (inc) to 1.4.3 (inc) |
| teconcedesign | crete_core | to 1.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69305 is a high-priority SQL Injection vulnerability in the WordPress Crete Core Plugin versions up to and including 1.4.3.
This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries directly on the database.
It is classified as a Blind SQL Injection issue, meaning attackers can manipulate database queries without seeing the direct output.
The vulnerability falls under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
This vulnerability can lead to serious impacts including unauthorized data theft and other malicious actions.
Because attackers can execute arbitrary SQL commands without authentication, they may manipulate or extract sensitive information from the database.
The vulnerability has a critical CVSS severity score of 9.3, indicating a high likelihood of exploitation and severe consequences.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2025-69305 is a Blind SQL Injection vulnerability in the WordPress Crete Core Plugin up to version 1.4.3 that allows unauthenticated attackers to execute arbitrary SQL queries.
While no specific detection commands are provided, typical detection methods for SQL Injection vulnerabilities include using web application security scanners or manual testing with SQL injection payloads in input fields or URL parameters related to the Crete Core plugin.
Network or system administrators can monitor for unusual database query patterns or error messages in logs that may indicate attempted exploitation.
Additionally, applying the mitigation rule provided by Patchstack can help block exploitation attempts and serve as a detection mechanism.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the mitigation rule provided by Patchstack, which can block attacks exploiting this vulnerability until an official patch is released.
Users are strongly advised to implement this mitigation immediately to protect their websites running the Crete Core plugin versions up to 1.4.3.
Since no official patch is available as of the publication date, applying this mitigation is the best immediate defense.
Additionally, monitoring and restricting access to the affected plugin and reviewing database logs for suspicious activity can help reduce risk.