CVE-2025-13000 — Vulnerability intelligence

jimbob1953 — db-access

Published: 2025-12-02T06:15:45.160

CVSS

7.7

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks

Sources

• CVE-2025-13000
• Exploit, Third Party Advisory