SQL Injection Vulnerability in ProfileGrid by Metagauss
CVE-2025-47478

8.5HIGH

Key Information:

Vendor: WordPress
Status: Profilegrid
Vendor: CVE Published:; 23 May 2025

What is CVE-2025-47478?

An SQL injection vulnerability has been identified in ProfileGrid, a user profile and community management plugin by Metagauss. This flaw allows attackers to improperly manipulate SQL commands, potentially leading to unauthorized access to database information. The vulnerability impacts versions up to and including 5.9.5.0, making it crucial for users to update to the latest version to safeguard their applications against potential exploits.

Affected Version(s)

ProfileGrid <= 5.9.5.0

References

https://patchstack.com/database/wordpress/plugin/profileg...

vdb-entry

CVSS V3.1

Score:

8.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 23, 2025
Vulnerability Reserved
May 7, 2025

Credit

Trương Hữu Phúc (truonghuuphuc) (Patchstack Alliance)