SQL Injection Vulnerability in Blappsta Mobile App Plugin for WordPress
CVE-2025-9200
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 October 2025
What is CVE-2025-9200?
The Blappsta Mobile App Plugin for WordPress contains a SQL injection vulnerability through the nh_ynaa_comments() function. This issue arises from inadequate escaping of user-supplied parameters combined with an unrefined SQL query setup. As a result, unauthenticated attackers can exploit this vulnerability to inject malicious SQL commands, potentially leading to unauthorized access and the extraction of sensitive data from the site's database.
Affected Version(s)
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App * <= 0.8.8.8