Platform
wordpress
Component
wp-hrm-lite-human-resource-management-system
Fixed in
1.1.1
CVE-2025-46455 describes a SQL Injection vulnerability discovered in WP HRM LITE, a WordPress plugin for human resource management. This flaw allows attackers to inject malicious SQL code, potentially leading to unauthorized data access and manipulation. The vulnerability impacts versions from 0.0.0 up to and including 1.1, and a patch is available in version 1.1.1.
Successful exploitation of this SQL Injection vulnerability could grant an attacker complete control over the WordPress database. This includes the ability to read, modify, or delete sensitive data such as user credentials, employee records, and financial information. An attacker could also leverage this access to escalate privileges, gain remote code execution on the server, or launch further attacks against other systems within the network. The potential blast radius is significant, particularly for organizations relying on WP HRM LITE to manage critical HR data.
CVE-2025-46455 has been publicly disclosed and is considered a high-priority vulnerability due to its critical severity and the potential for widespread exploitation. While no active campaigns have been publicly reported at the time of writing, the availability of SQL Injection vulnerabilities often leads to opportunistic attacks. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge, increasing the risk of exploitation.
Exploit Status
EPSS
0.23% (46% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-46455 is to immediately upgrade WP HRM LITE to version 1.1.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the vulnerable endpoints using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block any SQL injection attempts targeting the affected parameters. Regularly monitor database logs for suspicious activity and implement strong password policies to limit the impact of a potential breach. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection payload on the affected endpoint and verifying that it is properly sanitized.
Update the WP HRM LITE plugin to a patched version. Check the plugin website or the WordPress repository for the latest available version. As a SQL Injection vulnerability, it is recommended to perform a security audit of the plugin code to prevent future vulnerabilities.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-46455 is a critical SQL Injection vulnerability affecting WP HRM LITE versions 0.0.0–1.1, allowing attackers to inject malicious SQL code and potentially access sensitive data.
You are affected if you are using WP HRM LITE versions 0.0.0 through 1.1. Check your plugin version and upgrade immediately if vulnerable.
Upgrade WP HRM LITE to version 1.1.1 or later to patch the SQL Injection vulnerability. Consider WAF rules as a temporary workaround if immediate upgrade is not possible.
While no active campaigns have been publicly reported, the vulnerability's critical severity makes it a likely target for exploitation. Monitor your systems closely.
Refer to the IndigoThemes website and WordPress plugin repository for the official advisory and update information regarding CVE-2025-46455.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.