CVE-2025-23967 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection (SQLi) in 'GG Bought Together for WooCommerce'. 💥 **Consequences**: Attackers can manipulate database queries. Risks include data theft, data loss, or full system compromise.…

🛡️ **Root Cause**: CWE-89 (SQL Injection). 🔍 **Flaw**: The plugin fails to properly sanitize user-supplied input before constructing SQL queries. Allows malicious SQL code execution.

📦 **Affected**: WordPress Plugin: **GG Bought Together for WooCommerce**. 📅 **Versions**: **1.0.2 and earlier**. 🏢 **Vendor**: wpopal.

💀 **Attacker Actions**: 1. Extract sensitive database data (Users, Orders, Configs). 2. Modify or delete database records. 3. Potentially gain administrative control over the WordPress site. 4.…

🔓 **Threshold**: **LOW**. ✅ **Auth**: None required (PR:N). ✅ **UI**: No user interaction needed (UI:N). ✅ **Access**: Network accessible (AV:N). ⚠️ **Complexity**: Low (AC:L). Easy to exploit remotely.

📜 **Public Exp?**: No specific PoC code provided in data. 🌐 **References**: Patchstack database entries exist. ⚠️ **Status**: Likely exploitable given CVSS 3.1 vector and nature of SQLi, but no verified wild exploit conf…

🔍 **Self-Check**: 1. Scan for plugin 'GG Bought Together for WooCommerce'. 2. Check version number (≤ 1.0.2). 3. Use SQLi scanners on WooCommerce endpoints. 4. Monitor database logs for anomalous query patterns.

🩹 **Fix**: Update plugin to version **1.0.3 or later**. 🔗 **Source**: Patchstack database provides vulnerability details. ✅ **Official**: Vendor 'wpopal' is responsible for the patch.

🚧 **No Patch Workaround**: 1. **Disable/Deactivate** the plugin immediately. 2. Use WAF (Web Application Firewall) to block SQLi payloads. 3. Restrict database access permissions. 4. Monitor for suspicious activity.

⚡ **Urgency**: **HIGH**. 📊 **CVSS**: 3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. 🎯 **Priority**: Immediate action required. Remote, unauthenticated, low complexity. Protect customer data and site integrity now.