CVE-2025-67945: SQL Injection in MailerLite WooCommerce

Successful exploitation of this SQL Injection vulnerability could grant an attacker unauthorized access to the WooCommerce database. This could lead to the exfiltration of sensitive customer data, including personal information, order details, and payment information. Furthermore, an attacker could potentially modify or delete data, disrupt WooCommerce operations, or even gain control of the entire WordPress site. The impact is particularly severe given the prevalence of WooCommerce and the sensitivity of the data it handles. While no specific real-world exploitation has been publicly reported, the severity of SQL Injection vulnerabilities generally makes them high-priority targets.

1. Reserved2025-12-15
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67945 is to immediately upgrade the MailerLite – WooCommerce integration plugin to version 3.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious SQL injection attempts targeting the vulnerable endpoints. Specifically, look for patterns associated with SQL injection payloads in incoming requests. Additionally, review and restrict database user permissions to limit the potential damage from a successful attack. After upgrading, confirm the fix by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is properly blocked.

Active installs

30KKnown

Plugin rating