CVE-2025-62093: 
WordPress vulnerability analysis and mitigation

CVE-2025-62093 is a SQL Injection vulnerability in the LambertGroup Image&Video FullScreen Background WordPress plugin (slug: lbg_fullscreen_fullwidth_slider), affecting all versions up to and including 1.6.7. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on August 29, 2025, and published by Patchstack on September 28, 2025. It carries a CVSS v3.1 base score of 8.5 (High) (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is incorporated into SQL queries without adequate sanitization or parameterization. An authenticated attacker with low privileges (Contributor or Developer role) can inject malicious SQL commands through the plugin's functionality, exploiting the changed scope to potentially affect resources beyond the plugin itself. No specific vulnerable parameter or endpoint has been publicly documented beyond the plugin slug lbg_fullscreen_fullwidth_slider, and no public proof-of-concept code has been released (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to directly interact with the WordPress site's underlying database, enabling retrieval of sensitive information such as user credentials, personal data, and configuration secrets. The CVSS scoring reflects high confidentiality impact and low integrity impact with a changed scope, meaning the attacker could potentially read or partially modify data across database boundaries. Authentication bypass is also a potential consequence if credential tables are accessible via the injection (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the high CVSS score. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE (Patchstack).

As of the Patchstack disclosure, no official patched version is available from the plugin vendor. Site administrators should immediately remove or deactivate the Image&Video FullScreen Background plugin until a patched version (above 1.6.7) is released. Additional mitigations include implementing a web application firewall (WAF) with SQL injection rules, applying least-privilege database permissions to the WordPress database user, and monitoring database access logs for anomalous query patterns (Patchstack).