SQL Injection Vulnerability in WP Text Expander by Andrei Filonov
CVE-2025-49421

7.6HIGH

Key Information:

Vendor

WordPress
Status
WP Text Expander
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49421?

A SQL Injection vulnerability has been identified in the WP Text Expander plugin by Andrei Filonov, allowing attackers to manipulate SQL queries made by the application. This flaw can potentially enable unauthorized access to database information, leading to data breaches or the execution of arbitrary commands on the server. It specifically affects versions from n/a to 1.0.1 of the plugin, and users are encouraged to review their security measures and apply patches or updates as necessary to mitigate the risks.

Affected Version(s)

WP Text Expander <= 1.0.1

References

https://patchstack.com/database/wordpress/plugin/wp-text-...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chu The Anh (Blue Rock) (Patchstack Alliance)
.
CVE-2025-49421 : SQL Injection Vulnerability in WP Text Expander by Andrei Filonov