CVE-2025-22710: 
WordPress vulnerability analysis and mitigation

The Smart Manager WordPress plugin contains an SQL Injection vulnerability (CVE-2025-22710) that affects versions up to and including 8.52.0. The vulnerability was discovered by Webula and publicly disclosed on January 15, 2025. The issue allows authenticated users with administrator-level access to perform blind SQL injection attacks due to insufficient escaping of user-supplied parameters and inadequate preparation of SQL queries (Patchstack, WPScan).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and has received a CVSS v3.1 score of 7.6 (High). The issue stems from insufficient escaping on user-supplied parameters and lack of proper preparation of SQL queries, which enables authenticated administrators to append additional SQL queries to existing ones (NVD, Patchstack).

The vulnerability allows authenticated attackers with administrator-level access to extract sensitive information from the database by appending additional SQL queries to existing ones. This could potentially lead to unauthorized access to sensitive data stored in the WordPress database (Patchstack).

The vulnerability has been patched in version 8.53.0 of the Smart Manager plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).