CVE-2025-2319 json
EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution
published 2025-03-25 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-8060
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTS_menu' function. This makes it possible for unauthenticated attackers to execute code on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Version 5.25.10 adds a nonce check, which makes this vulnerability exploitable by admins only.
Patch / fix
- ieonly ez_sql_reports_shortcode_widget_and_db_backup 5.25.10
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- scheeeli EZ SQL Reports Shortcode Widget and DB Backup
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/eade6ab0-ff79-4107-83ce-e85b37d97442?source=cve
- plugins.trac.wordpress.org /browser/elisqlreports/tags/5.25.08/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/5.21.35/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4.17.42/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4.17.38/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4.16.38/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4.11.37/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4..11.33/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4..11.15/index.php
- plugins.trac.wordpress.org /browser/elisqlreports/tags/4..11.13/index.php
Sources
- CVE List CVE-2025-2319
- NVD CVE-2025-2319
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.