CVE-2025-69337: 
WordPress vulnerability analysis and mitigation

CVE-2025-69337 is a Blind SQL Injection vulnerability in the Wolmart Core WordPress plugin developed by don-themes (d-themes). It affects all versions of Wolmart Core through 1.9.6 and allows unauthenticated remote attackers to extract sensitive database contents without direct visibility of query results. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 9.3 (Critical) (Feedly, Wordfence).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from insufficient sanitization of user-supplied input before it is incorporated into SQL queries within the Wolmart Core plugin. Because the injection is "blind," query results are not directly returned to the attacker; instead, the attacker infers database contents through boolean-based or time-based side-channel techniques. No authentication or user interaction is required, and the attack is conducted entirely over the network, making it trivially accessible to remote, unauthenticated adversaries (Feedly).

Successful exploitation allows an unauthenticated attacker to extract the full contents of the WordPress database, potentially exposing user credentials, personal data, order information, and other confidential records stored by the Wolmart WooCommerce theme. The CVSS scoring reflects a high confidentiality impact with a changed scope, indicating that data beyond the plugin's immediate context may be accessible. Availability is also marginally degraded due to the resource overhead of blind injection queries, though integrity is not directly impacted (Feedly).

There is currently no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.021%, reflecting a low near-term probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of active exploitation, the unauthenticated, network-accessible attack vector and critical CVSS score make it a high-priority patching target.

1. Reconnaissance: Identify WordPress sites using the Wolmart Core plugin (version ≤ 1.9.6) via passive techniques such as checking plugin paths (e.g., /wp-content/plugins/wolmart-core/) or using tools like WPScan.
2. Identify injectable parameter: Probe plugin-exposed endpoints or AJAX handlers for parameters that are passed unsanitized to SQL queries.
3. Craft blind SQL injection payload: Construct boolean-based or time-based payloads (e.g., using AND SLEEP(5) or conditional expressions) to confirm the injection point without direct output.
4. Extract database contents: Use automated tools such as sqlmap with blind injection techniques to enumerate databases, tables, and columns, then dump sensitive data such as WordPress user hashes and WooCommerce order records.
5. Leverage extracted credentials: Crack or reuse extracted password hashes to gain administrative access to the WordPress dashboard for further compromise (Feedly).

• Network: Unusual or high-volume HTTP requests to Wolmart Core plugin endpoints containing SQL metacharacters (e.g., ', --, AND, SLEEP, BENCHMARK) in query parameters.
• Logs: WordPress or web server access logs showing repeated requests with time delays consistent with time-based blind SQL injection (e.g., responses taking 5+ seconds); requests from a single IP to the same endpoint with incrementally varying payloads.
• Database: Unexpected spikes in database query execution time or query volume originating from the web application user; slow query logs showing repeated conditional or sleep-based queries.
• Process: Elevated MySQL/MariaDB CPU or I/O usage without corresponding legitimate traffic increases.

Site administrators should immediately update the Wolmart Core plugin to a version newer than 1.9.6, which is the primary and recommended remediation (Feedly, Wordfence). As interim mitigations, deploying a Web Application Firewall (WAF) with SQL injection detection rules can help block exploitation attempts. Additionally, restricting database user privileges to the minimum required and enabling slow query logging can limit impact and improve detection.

Wordfence included CVE-2025-69337 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as a notable SQL injection issue in the Wolmart Core plugin (Wordfence). No significant additional vendor statements or notable researcher commentary beyond standard vulnerability database entries have been observed at this time.