CVE-2025-68990

WordPress BWL Pro Voting Manager plugin <= 1.4.9 - SQL Injection vulnerability

View on CVE.org
Published Dec 30, 2025 CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

Analysis

AI-generated

Technical impact

An improper neutralization of special elements within SQL commands in the xenioushk BWL Pro Voting Manager plugin allows blind SQL injection. This flaw enables an attacker to execute arbitrary SQL statements against the database, potentially exfiltrating sensitive data, modifying vote counts, or elevating privileges. The weakness is a classic SQL injection (CWE‑89) which compromises confidentiality and integrity of data stored by the WordPress site.

Affected Systems

The vulnerability affects the BWL Pro Voting Manager WordPress plugin from any version up to and including 1.4.9. WordPress sites that have installed or enabled the plugin are at risk, regardless of the WordPress core version.

Risk and Exploitability

The CVSS score is 8.5, indicating a high severity. The EPSS score is below 1%, suggesting a low probability of being targeted currently, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves submitting crafted voting requests through the plugin’s public endpoints, as the input fields are not properly sanitized. Successful exploitation would require network access to the WordPress site but does not depend on privileged credentials.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the BWL Pro Voting Manager plugin to version 1.5.0 or later to remove the injection flaw.
  • If an update cannot be applied immediately, consider disabling or uninstalling the BWL Pro Voting Manager plugin to eliminate the attack surface.
  • Deploy a web application firewall with SQL injection filters to detect and block suspicious payloads targeting the plugin’s endpoints.

Generated by OpenCVE AI on April 29, 2026 at 15:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.
Title WordPress BWL Pro Voting Manager plugin <= 1.4.9 - SQL Injection vulnerability
Weaknesses CWE-89
References
Earlier changes (2)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:14 PM
Reserved
Dec 29, 2025, 11:18 AM

View source JSON

Updated
Dec 30, 2025, 9:38 PM

JSON

Status
Deferred
Published
Dec 30, 2025, 11:15 AM
Modified
Oct 7, 2026, 12:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 3:15 PM

JSON