CVE-2025-39484

WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability

View on CVE.org
Published Jan 5, 2026 CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.

Analysis

AI-generated

Technical impact

A flaw exists in the WordPress Entrada theme where unsanitized input is incorporated directly into SQL statements. The resulting SQL Injection can allow an attacker to execute arbitrary database commands. Depending on database privileges, this could lead to sensitive data extraction, modification, or even escalation of privileges within the site.

Affected Systems

The vulnerability affects the Waituk Entrada Theme for WordPress, versions up through 5.7.7. Users running any of those releases are potentially exposed.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating high severity, while the EPSS score is under 1%, suggesting that exploitation is currently unlikely but still possible. It is not listed in the CISA KEV catalog, but the inherent risk of remote injection remains. The likely attack vector is remote, via crafted requests to the WordPress site that exploit the insecure SQL handling. Creation of malicious payloads through public interfaces could trigger the flaw without additional authentication.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Entrada theme to a version newer than 5.7.7 to remove the vulnerable code.
  • If an upgrade cannot be applied immediately, disable or delete the Entrada theme from the WordPress installation to eliminate the attack surface.
  • Deploy a Web Application Firewall rule or similar input validation to block suspicious SQL injection payloads targeting the theme.

Generated by OpenCVE AI on April 30, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada entrada allows SQL Injection.This issue affects Entrada: from n/a through <= 5.7.7. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.
References
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada entrada allows SQL Injection.This issue affects Entrada: from n/a through <= 5.7.7.
References
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.
Title WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}
Earlier changes (4)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
Apr 16, 2025, 6:23 AM

View source JSON

Updated
Jan 5, 2026, 7:37 PM

JSON

Status
Deferred
Published
Jan 5, 2026, 5:15 PM
Modified
Oct 7, 2026, 10:10 AM

View source JSON

No data.

Updated
Apr 30, 2026, 2:30 PM

JSON