SQL Injection Vulnerability in WP Employee Attendance System by Suhas Surse
CVE-2025-28972

7.6HIGH

Key Information:

Vendor

WordPress
Status
WP Employee Attendance System
Vendor
CVE Published:
17 June 2025

What is CVE-2025-28972?

The WP Employee Attendance System by Suhas Surse is susceptible to a SQL Injection vulnerability which allows attackers to execute arbitrary SQL commands via user input. This enables potential data exposure and manipulation threats. The issue affects versions of the plugin up to 3.5, highlighting the need for urgent updates and security measures to protect sensitive information.

Affected Version(s)

WP Employee Attendance System <= 3.5

References

https://patchstack.com/database/wordpress/plugin/wp-emplo...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hiro (Code016Hiro) (Patchstack Alliance)
.
CVE-2025-28972 : SQL Injection Vulnerability in WP Employee Attendance System by Suhas Surse