CVE-2025-6717: 
WordPress vulnerability analysis and mitigation

The B1.lt plugin for WordPress (CVE-2025-6717) contains a SQL Injection vulnerability affecting all versions up to and including 2.2.56. The vulnerability was discovered and disclosed on July 18, 2025. The plugin has been temporarily closed since July 15, 2025, pending a full security review (NVD Database, WordPress Plugin).

The vulnerability stems from insufficient escaping of the 'id' parameter and inadequate preparation of existing SQL queries. The issue has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD Database).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to append additional SQL queries to existing ones, potentially enabling the extraction of sensitive information from the database (NVD Database).

The plugin has been temporarily closed and removed from the WordPress plugin repository as of July 15, 2025, pending a full security review. Users are advised to disable and remove the plugin until a patched version is released (WordPress Plugin).