CVE-2025-32924: 
WordPress vulnerability analysis and mitigation

The WordPress Revy plugin version 2.1 and below contains an SQL Injection vulnerability (CVE-2025-32924) discovered by researcher Cút lộn xào me and publicly disclosed on April 21, 2025. This security issue affects WordPress installations with the Revy plugin installed and requires Subscriber or higher privileges to exploit (Wiz, Patchstack).

The vulnerability is classified as an SQL Injection (CWE-89) and has been assigned a CVSS v3.1 score of 8.5 (High). The vulnerability requires Subscriber-level privileges for exploitation and falls under the OWASP Top 10 category A3: Injection (Patchstack).

This SQL Injection vulnerability could allow malicious actors to directly interact with the website's database, potentially leading to unauthorized data access and theft of sensitive information. The vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack).

While no official fix is currently available, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks. Website administrators are advised to implement the virtual patch immediately or consider removing the plugin until an official fix becomes available (Patchstack).