CVE-2025-6718

B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection

Published Jul 18, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.

Analysis

Technical impact

An authenticated subscriber can trigger the b1_run_query AJAX action that lacks a proper capability check. The flaw allows the attacker to inject and execute arbitrary SQL statements. This can lead to the disclosure of sensitive data, unauthorized modification or deletion of database contents, and potentially compromise the integrity and confidentiality of the entire site.

Affected Systems

The vulnerability affects the B1.lt plugin for WordPress, integrated with WooCommerce and sold by b1accounting:Site.pro. Versions 2.2.57 and earlier are impacted. Site owners running those versions should check the installed version and plan to upgrade.

Risk and Exploitability

The CVSS score of 8.8 reflects a high severity. EPSS indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with at least Subscriber-level access, which is normally granted to regular customers. Once authenticated, the attacker can dispatch the vulnerable AJAX endpoint and supply malicious SQL payloads. The lack of authorization control (CWE-862) is the root cause.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

b1accounting

Site.pro for WooCommerce

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.2.57

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the B1.lt plugin to the latest released version that removes the missing capability check.
If immediate update is not possible, limit access to the b1_run_query AJAX action to administrator users by adding a capability check or disabling the endpoint for lower roles.
Verify that default Subscriber accounts cannot execute arbitrary SQL commands; review site roles and permissions and consider removing the Subscriber role from users who should not have database access.

Generated by OpenCVE AI on April 21, 2026 at 03:59 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-21854	The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.355% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3329617%40b1-accounting&new=3329617%40b1-accounting&sfp_email=&sfph_mail=
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338792%40b1-accounting&new=3338792%40b1-accounting&sfp_email=&sfph_mail=
https://wordpress.org/plugins/b1-accounting/
https://www.wordfence.com/threat-intel/vulnerabilities/id/4e479a3f-ef1a-4476-89e1-86d0f388f2c3?source=cve

History

Apr 8, 2026 5:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description	The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.	The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.
Title	B1.lt for WooCommerce <= 2.2.56 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection	B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3329617%40b1-accounting&new=3329617%40b1-accounting&sfp_email=&sfph_mail= https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338792%40b1-accounting&new=3338792%40b1-accounting&sfp_email=&sfph_mail=

Jul 18, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 18, 2025 5:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.
Title		B1.lt for WooCommerce <= 2.2.56 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection
Weaknesses		CWE-862
References		https://wordpress.org/plugins/b1-accounting/ https://www.wordfence.com/threat-intel/vulnerabilities/id/4e479a3f-ef1a-4476-89e1-86d0f388f2c3?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`