CVE-2025-39370: 
WordPress vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2025-39370) was discovered in Cnilsson iCafe Library WordPress plugin affecting versions up to 1.8.3. The vulnerability was initially reported by security researcher 0x1ceKing on April 20, 2025, and was publicly disclosed by Patchstack on April 25, 2025 (Wiz Database, Patchstack Database).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 base score of 7.6 (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring high privileges (PR:H), no user interaction (UI:N), and has a changed scope (S:C). The impact metrics indicate high confidentiality impact (C:H), no integrity impact (I:N), and low availability impact (A:L) (Wiz Database).

The vulnerability could allow an authenticated attacker with Editor or higher privileges to directly interact with the database, potentially leading to unauthorized access to sensitive information stored in the WordPress database (Patchstack Database).

As of the disclosure date, no official fix is available for this vulnerability. Website administrators running affected versions of the iCafe Library plugin (versions up to 1.8.3) should consider implementing additional security controls or removing the plugin if not essential (Wiz Database).