SQL Injection Vulnerability in PGS Core Plugin for WordPress

CVE-2025-0853

What is CVE-2025-0853?

The PGS Core plugin for WordPress is susceptible to SQL Injection through the 'event' parameter in the 'save_header_builder' function. This vulnerability arises from improper escaping of user-supplied parameters and an inadequate setup of the SQL query. As a result, unauthenticated attackers can exploit this flaw by appending malicious SQL commands to existing queries. This capability could potentially permit the extraction of sensitive information from the database, posing a significant security risk.

References