SQL Injection Vulnerability in weDevs Appsero Helper Plugin
CVE-2025-39377

8.5HIGH

Key Information:

Vendor

Wedevs

Status
Appsero Helper
Vendor
CVE Published:
24 April 2025

What is CVE-2025-39377?

The weDevs Appsero Helper plugin is susceptible to an SQL Injection vulnerability, specifically due to improper neutralization of special elements in SQL commands. This flaw can potentially allow attackers to manipulate database queries, leading to unauthorized access to sensitive data. The issue is present in all versions prior to 1.3.4, leaving those implementations exposed to exploits. Ensuring timely updates and proper security measures is essential to defend against such vulnerabilities.

Affected Version(s)

Appsero Helper 0 <= 1.3.4

References

https://patchstack.com/database/Wordpress/Plugin/appsero-...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trương Hữu Phúc (truonghuuphuc) (Patchstack Alliance)
.