CVE-2025-49854: 
WordPress vulnerability analysis and mitigation

CVE-2025-49854 is an SQL Injection vulnerability in the Slim SEO WordPress plugin by Anh Tran, affecting all versions up to and including 4.5.4. The vulnerability was reported on May 25, 2025, and publicly disclosed on June 12, 2025, by Patchstack, with NVD publication on June 17, 2025. It carries a CVSS v3.1 base score of 7.6 (High), requiring high privileges (Administrator) to exploit (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is not properly sanitized before being incorporated into SQL queries within the Slim SEO plugin. Exploitation requires network access and high-level privileges (Administrator role), but no user interaction, and the scope is changed — indicating the impact extends beyond the vulnerable component itself. No public proof-of-concept code or detailed technical write-up has been identified at this time (Patchstack, Red Hat CVE).

Successful exploitation allows an authenticated administrator-level attacker to directly interact with the WordPress site's underlying database, primarily resulting in high confidentiality impact (e.g., extraction of sensitive data such as user credentials, personal information, and site configuration). Integrity impact is rated none, while availability impact is low. The changed scope indicates potential for data exposure beyond the plugin's own database context (Patchstack).

No known public exploit code or active in-the-wild exploitation has been reported for CVE-2025-49854. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited due to the high privilege requirement (Patchstack, CISA Bulletin).

The vendor has released version 4.5.5 of the Slim SEO plugin, which resolves this vulnerability. Administrators should update the plugin to version 4.5.5 or later immediately via the WordPress dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No alternative workarounds have been documented (Patchstack).

Patchstack, which coordinated the disclosure through its Active VDP program, credited researcher ChuongVN for the discovery and classified the vulnerability as low priority given the high privilege requirement. No notable broader media coverage or significant community discussion has been identified beyond standard vulnerability database entries (Patchstack).