CVE-2025-32203: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2025-32203) was discovered in the WordPress plugin Falling things, affecting versions up to 1.08. The vulnerability was reported by researcher astra.r3verii on February 4, 2025, and was publicly disclosed on April 4, 2025 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) with a CVSS v3.1 base score of 7.6 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H) and no user interaction (UI:N). The scope is changed (S:C) with high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L) (Patchstack).

The vulnerability could allow a malicious actor with editor or higher privileges to directly interact with the database, potentially leading to unauthorized access to sensitive information stored in the WordPress database (Patchstack).

The vulnerability requires high privileges (Editor+ level access) to exploit, which significantly reduces its potential impact. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 1.09 of the Falling things plugin. Users are advised to update to version 1.09 or later to remove the vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins as an additional security measure (Patchstack).