CVE-2025-69304: SQL Injection in Allmart WordPress Theme

The SQL Injection vulnerability in Allmart allows an attacker to bypass security measures and directly interact with the underlying database. Due to the blind nature of the injection, attackers must iteratively probe the database to extract information, making the process time-consuming but still feasible. Sensitive data at risk includes user credentials, customer information, order details, and potentially even database schema information. Successful exploitation could lead to complete compromise of the WordPress site and its associated data. This vulnerability shares similarities with other SQL injection flaws where attackers can bypass authentication and gain administrative access.

1. Reserved2025-12-31
2. Published2026-02-20
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-69304 is to upgrade to a patched version of the Allmart WordPress theme as soon as it becomes available. In the interim, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block SQL injection attempts targeting the vulnerable endpoints. Consider using parameterized queries or prepared statements in your WordPress code to prevent SQL injection vulnerabilities in the future. Regularly review and sanitize user inputs to further reduce the attack surface.