CVE-2025-2221

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-222107.2A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to ex CVE-2025-222113.4A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) t CVE-2025-222122.7A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (adminis CVE-2025-222137.1Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php CVE-2025-222144.3Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.CVE-2025-222154.3VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to A CVE-2025-222165.4A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated agai CVE-2025-222178.6Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are availabl CVE-2025-222187.7VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be CVE-2025-222199.0VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges m CVE-2025-22227.8CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privi CVE-2025-222205.4VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and netw