CVE-2025-67945: 
WordPress vulnerability analysis and mitigation

CVE-2025-67945 is a SQL Injection vulnerability in the MailerLite – WooCommerce integration WordPress plugin (slug: woo-mailerlite) that allows unauthenticated remote attackers to execute arbitrary SQL commands against the underlying database. It affects all plugin versions up to and including 3.1.2, with version 3.1.3 containing the fix. The vulnerability was reported by researcher NumeX on November 4, 2025, and publicly disclosed by Patchstack on January 20–22, 2026. It carries a CVSS v3.1 base score of 9.3 (Critical), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from insufficient sanitization or parameterization of user-supplied input before it is incorporated into SQL queries within the plugin. Because no authentication is required (PR:N) and no user interaction is needed (UI:N), an attacker can send a crafted HTTP request directly to a vulnerable endpoint exposed by the plugin on any WordPress/WooCommerce site running the affected version. The scope is marked as Changed (S:C), indicating that the impact extends beyond the plugin itself to the broader database and potentially the WordPress installation. No public proof-of-concept code has been identified, but Patchstack notes the vulnerability class is commonly used in mass-exploit campaigns (Patchstack).

Successful exploitation grants an unauthenticated attacker direct read access to the WordPress database, enabling theft of sensitive data including customer PII, order details, WooCommerce configuration, WordPress user credentials (hashed passwords), and API keys or secrets stored in the database. The Changed scope means the confidentiality impact is rated High and extends beyond the plugin's own data boundary. While availability impact is rated Low (limited disruption) and integrity impact is Low-to-None, credential theft could enable follow-on account takeover and full site compromise (Patchstack).

Patchstack has flagged this vulnerability as "Known to be exploited" and notes it is expected to be used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site traffic or popularity. The EPSS score is approximately 0.021% (0.000210), reflecting a relatively low but non-zero probability of exploitation in the near term. No specific threat actor attribution or public exploit kit inclusion has been reported. The vulnerability requires no authentication and no user interaction, making it trivially exploitable by automated scanners (Patchstack).

1. Reconnaissance: Use tools like WPScan, Shodan, or Censys to identify WordPress/WooCommerce sites with the woo-mailerlite plugin installed and running version 3.1.2 or earlier.
2. Identify vulnerable endpoint: Probe the site for plugin-specific REST API routes or front-end endpoints registered by the MailerLite WooCommerce integration plugin that accept user-supplied parameters.
3. Craft SQL injection payload: Construct an HTTP request (GET or POST) to the vulnerable endpoint with a malicious SQL payload injected into the relevant parameter (e.g., appending ' OR 1=1-- or time-based blind injection payloads such as ' AND SLEEP(5)--).
4. Extract data: Use automated tools such as sqlmap targeting the identified endpoint to enumerate databases, tables, and extract sensitive records (e.g., wp_users, wp_options, order tables).
5. Leverage extracted credentials: Crack or use extracted WordPress admin password hashes to gain administrative access, enabling further site compromise, malware installation, or data exfiltration (Patchstack).

• Network: Unusual HTTP requests to WordPress/WooCommerce endpoints associated with the MailerLite plugin containing SQL metacharacters (', --, OR 1=1, UNION SELECT, SLEEP(, BENCHMARK() in query parameters or POST body.
• Logs: WordPress or web server access logs showing repeated requests to plugin-specific endpoints with encoded or obfuscated SQL payloads; anomalous spikes in database query errors in PHP/MySQL error logs.
• Database: Unexpected queries in MySQL general query log referencing UNION, INFORMATION_SCHEMA, or SLEEP; unauthorized reads of wp_users or wp_options tables from the web application user.
• File System: New or modified PHP files in the WordPress uploads directory or plugin folders, potentially indicating post-exploitation webshell deployment following credential theft.

The vendor has released version 3.1.3 of the MailerLite – WooCommerce integration plugin, which resolves this vulnerability. Site administrators should update to version 3.1.3 or later immediately via the WordPress admin dashboard or WP-CLI. As a temporary workaround for sites unable to update immediately, Patchstack offers a virtual patching/mitigation rule that blocks exploitation attempts. Additionally, restricting database user privileges to the minimum required and enabling a web application firewall (WAF) with SQL injection rules can reduce risk (Patchstack).

Wordfence included CVE-2025-67945 in its weekly WordPress vulnerability report for the week of January 19–25, 2026, highlighting it as a notable SQL injection issue in the WooCommerce ecosystem (Wordfence). A social media post on Bluesky by a cybersecurity account also referenced the vulnerability in mid-2026, indicating continued community awareness. Patchstack, as the assigning CNA, emphasized the mass-exploit campaign risk associated with this vulnerability class in WordPress plugins.