CVE-2025-2248: WP-PManager <= 1.2 - Admin+ SQL Injection
Published May 15, 2025
·Updated
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Affected Software
2 affected components
WP-PManager WP-PManager<=1.2
Mantus667 Wp-pmanager Wordpress<=1.2
Event History
May 15, 2025
CVE Published
via MITRE·08:07 PM
Data Sourced
via MITRE·08:07 PM
DescriptionWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-2248?
CVE-2025-2248 is categorized as a high severity vulnerability due to its potential for SQL injection attacks.
2
How do I fix CVE-2025-2248?
To fix CVE-2025-2248, update the WP-PManager plugin to the latest version that addresses this SQL injection flaw.
3
What kind of attack does CVE-2025-2248 allow?
CVE-2025-2248 allows for SQL injection attacks, which could enable unauthorized database access and data manipulation.
4
Who is affected by CVE-2025-2248?
Administrators using the WP-PManager WordPress plugin version up to 1.2 are affected by CVE-2025-2248.
5
What is the cause of CVE-2025-2248?
CVE-2025-2248 is caused by a failure to properly sanitize and escape user input in SQL statements within the WP-PManager plugin.