CVE-2025-48091: 
WordPress vulnerability analysis and mitigation

CVE-2025-48091 is a SQL Injection vulnerability discovered in the Alexander AnyComment WordPress plugin, affecting versions up to 0.3.6. The vulnerability was disclosed on October 22, 2025, and was initially reported through Patchstack's vulnerability disclosure program (NVD Database).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), identified as CWE-89. The CVSS v3.1 base score was assessed at 8.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating a network-accessible vulnerability requiring low attack complexity and low privileges (NVD Database).

The vulnerability allows attackers with subscriber-level access or higher to perform SQL injection attacks against the affected WordPress installations. This could potentially lead to unauthorized access to sensitive database information and possible modification of database contents (Patchstack).

Users are advised to update their AnyComment WordPress plugin to a version newer than 0.3.6 when available. In the meantime, it is recommended to implement additional security measures such as web application firewalls and limiting user privileges (Patchstack).