SQL Injection Vulnerability in tagDiv Opt-In Builder Plugin for WordPress
CVE-2025-2890

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Tagdiv Opt-in Builder
Vendor
CVE Published:
30 April 2025

What is CVE-2025-2890?

The tagDiv Opt-In Builder plugin for WordPress is vulnerable to SQL injection through the 'subscriptionCouponId' parameter due to inadequate escaping of user inputs and lack of proper SQL query preparation. This vulnerability allows authenticated users with Subscriber-level access or higher to inject additional SQL queries, potentially exposing sensitive database information. Site administrators should ensure they update the plugin to the latest version to mitigate this risk.

Affected Version(s)

tagDiv Opt-In Builder 0 <= 1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://tagdiv.com/newspaper-changelog/
https://themeforest.net/item/newspaper/5489609

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Truoc Phan
.