CVE-2025-1986 | THREATINT

Description

The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Reserved 2025-03-05 | Published 2025-04-01 | Updated 2025-04-01 | Assigner WPScan

Problem types

CWE-89 SQL Injection

Product status

Default status

unaffected

Any version before 3.4.7

affected

Credits

Greshow finder

WPScan coordinator

References

wpscan.com/...rability/f1414750-19ee-4a5d-b255-a9c20168b716/ exploit vdb-entry technical-description

cve.org (CVE-2025-1986)

nvd.nist.gov (CVE-2025-1986)

Download JSON