Platform
wordpress
Component
torod
Fixed in
2.1.1
CVE-2025-30936 identifies a SQL Injection vulnerability within Torod, a component used in WordPress environments. This vulnerability allows attackers to inject malicious SQL code into database queries, potentially leading to unauthorized data access and modification. The vulnerability affects versions from 0.0.0 through 2.1, and a fix is available in version 1.9.1.
Successful exploitation of this SQL Injection vulnerability can have severe consequences. An attacker could bypass authentication mechanisms, gain access to sensitive user data (including usernames, passwords, and personal information), and potentially modify or delete critical database records. Depending on the database structure and permissions, an attacker might even be able to execute arbitrary commands on the server. The blast radius extends to any WordPress site utilizing the vulnerable Torod component, potentially impacting a large number of users and sensitive data.
CVE-2025-30936 was publicly disclosed on 2025-07-16. The CVSS score of 9.3 (CRITICAL) indicates a high probability of exploitation. While no public proof-of-concept (PoC) has been observed at the time of writing, the severity of the vulnerability and the ease of SQL Injection exploitation suggest that it is a likely target for attackers. Monitor security advisories and threat intelligence feeds for any signs of active exploitation.
Exploit Status
EPSS
0.04% (12% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-30936 is to immediately upgrade Torod to version 1.9.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL injection attempts. Specifically, look for patterns involving single quotes, double quotes, semicolons, and SQL keywords. Regularly review database access logs for suspicious activity. After upgrading, confirm the fix by attempting a SQL injection payload through the vulnerable endpoint and verifying that it is properly sanitized.
Update the Torod plugin to the latest available version to mitigate the SQL Injection vulnerability. Check for plugin updates in the WordPress admin panel or through the official WordPress.org repository.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-30936 is a critical SQL Injection vulnerability affecting Torod versions 0.0.0 through 2.1, allowing attackers to manipulate database queries and potentially access sensitive data.
If your WordPress site uses Torod version 0.0.0 to 2.1, you are affected. Check your plugin versions and upgrade immediately.
Upgrade Torod to version 1.9.1 or later. If upgrading is not possible, implement a WAF rule to filter malicious SQL injection attempts.
While no active exploitation has been confirmed, the high CVSS score and ease of exploitation suggest it is a likely target. Continuous monitoring is recommended.
Refer to the official Torod project website or WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.