SQL Injection Vulnerability in Smart Notification by Smartiolabs
CVE-2025-39479

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Smart Notification
Vendor
CVE Published:
17 June 2025

What is CVE-2025-39479?

The Smart Notification plugin by Smartiolabs contains a vulnerability that allows for Blind SQL Injection due to improper handling of special elements in SQL commands. This flaw can be exploited by an attacker to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information. Versions from n/a through 10.3 are affected, emphasizing the need for immediate attention and remediation to protect against potential exploitation.

Affected Version(s)

Smart Notification <= 10.3

References

https://patchstack.com/database/wordpress/plugin/smio-pus...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds (Patchstack Alliance)
.
CVE-2025-39479 : SQL Injection Vulnerability in Smart Notification by Smartiolabs