CVE-2025-39474: WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability
Published Jun 27, 2025
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely amely allows SQL Injection.This issue affects Amely: from n/a through <= 3.1.4.
Affected Software
3 affected components
ThemeMove Amely<=3.1.4
WordPress Amely<=3.1.4
ThemeMove Amely Wordpress<3.2.0
Remediation
Information
Update the WordPress Amely theme to the latest available version (at least 3.2.0).
Event History
Jun 27, 2025
CVE Published
via MITRE·11:52 AM
Data Sourced
via MITRE·11:52 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-39474?
CVE-2025-39474 is classified as a high severity SQL Injection vulnerability in ThemeMove Amely.
2
How do I fix CVE-2025-39474?
To fix CVE-2025-39474, update ThemeMove Amely to version 3.1.5 or later.
3
What software is affected by CVE-2025-39474?
CVE-2025-39474 affects ThemeMove Amely versions up to 3.1.4.
4
What could happen if CVE-2025-39474 is exploited?
Exploitation of CVE-2025-39474 could allow attackers to execute arbitrary SQL queries, leading to data leakage or manipulation.
5
Is CVE-2025-39474 related to WordPress?
Yes, CVE-2025-39474 also affects the WordPress version of ThemeMove Amely up to version 3.1.4.