Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bulktheme WOOEXIM wooexim allows SQL Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
Published: 2025-01-07
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WOOEXIM WordPress plugin from bulktheme contains an SQL injection flaw that allows an attacker to insert arbitrary SQL statements. By exploiting this weakness, the attacker can read, modify, delete, or exfiltrate data from the database, potentially compromising the entire site.

Affected Systems

This affects the bulktheme WOOEXIM plugin for WordPress, versions up to and including 5.0.0. Any WordPress installation that has not updated beyond 5.0.0 is vulnerable.

Risk and Exploitability

The CVSS score of 7.6 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in the CISA’s KEV catalog. The likely attack vector is through the web interface of the plugin, enabling remote attackers to send crafted requests that cause SQL commands to run.

Generated by OpenCVE AI on May 1, 2026 at 22:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update WOOEXIM to the latest version above 5.0.0.
  • If an immediate update is not possible, temporarily disable or remove the plugin to prevent exploitation.
  • If the vulnerable version must remain, ensure that all SQL queries within the plugin are parameterized or that user input is properly sanitized to mitigate the injection risk.

Generated by OpenCVE AI on May 1, 2026 at 22:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-2811 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WOOEXIM.COM WOOEXIM allows SQL Injection.This issue affects WOOEXIM: from n/a through 5.0.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WOOEXIM.COM WOOEXIM allows SQL Injection.This issue affects WOOEXIM: from n/a through 5.0.0. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bulktheme WOOEXIM wooexim allows SQL Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}

Tue, 07 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jan 2025 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WOOEXIM.COM WOOEXIM allows SQL Injection.This issue affects WOOEXIM: from n/a through 5.0.0.
Title WordPress WOOEXIM Plugin <= 5.0.0 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:00.900Z

Reserved: 2025-01-07T10:22:58.147Z

Link: CVE-2025-22533

cve-icon Vulnrichment

Updated: 2025-01-07T16:38:56.064Z

cve-icon NVD

Status : Deferred

Published: 2025-01-07T16:15:48.980

Modified: 2026-06-17T08:48:03.733

Link: CVE-2025-22533

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T22:15:27Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')