CVE-2025-1648

Summary

CVE-2025-1648: The Yawave plugin for WordPress contains a SQL Injection vulnerability that affects versions up to and including 2.9.1. This issue stems from insufficient escaping of user-supplied data in the 'lbid' parameter, allowing attackers to inject additional SQL queries into existing ones. Consequently, unauthenticated adversaries can access sensitive information from the database without proper authorization.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.