CVE-2025-22290 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection). The flaw stems from improper neutralization of special elements used in SQL commands within the plugin's code. ❌ No input validation/sanitization before execution.

Q: Who is affected? (Versions/Components)

🎯 **Affected**: WordPress Plugin: **LTL Freight Quotes – FreightQuote Edition**. 📦 **Version**: **2.3.11** and all **previous versions**. Vendor: **enituretechnology**.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🚫 **Auth**: None required (PR:N). 🖱️ **User Interaction**: None (UI:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit remotely without credentials.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exploit**: **Unknown/Not Listed**. The provided data shows empty `pocs` array. ⚠️ However, SQLi is a well-understood vector; generic PoCs likely exist or can be crafted easily given the low complexity.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: **Yes**. The vulnerability is tracked (CVE-2025-22290). 📅 **Published**: 2025-02-16. Users should update to the latest version provided by the vendor to patch the SQLi flaw.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 🚨 **Priority**: Immediate action required. Remote, unauthenticated, low-complexity SQLi with High Confidentiality impact. Update immediately to prevent data breaches.

Updated May 06, 2026 CVSS 9.3 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in 'LTL Freight Quotes' plugin.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection). The flaw stems from improper neutralization of special elements used in SQL commands within the plugin's code. ❌ No input validation/sanitization before execution.

Q3Who is affected? (Versions/Components)

🎯 **Affected**: WordPress Plugin: **LTL Freight Quotes – FreightQuote Edition**. 📦 **Version**: **2.3.11** and all **previous versions**. Vendor: **enituretechnology**.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: With **CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L)**, attackers can: 🔓 **High Confidentiality Impact**: Steal sensitive DB data. ⚠️ **Low Availability Impact**: Disrupt service.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🚫 **Auth**: None required (PR:N). 🖱️ **User Interaction**: None (UI:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit remotely without credentials.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exploit**: **Unknown/Not Listed**. The provided data shows empty `pocs` array. ⚠️ However, SQLi is a well-understood vector; generic PoCs likely exist or can be crafted easily given the low complexity.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check WordPress Admin for plugin version. 2. Scan for 'LTL Freight Quotes' by 'enituretechnology'. 3. Verify version is **≤ 2.3.11**. 4.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: **Yes**. The vulnerability is tracked (CVE-2025-22290). 📅 **Published**: 2025-02-16. Users should update to the latest version provided by the vendor to patch the SQLi flaw.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. **Disable/Uninstall** the plugin if not essential. 2. **WAF Rules**: Block SQLi patterns in query parameters related to freight quotes. 3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 🚨 **Priority**: Immediate action required. Remote, unauthenticated, low-complexity SQLi with High Confidentiality impact. Update immediately to prevent data breaches.

Continue exploring

Vulnerability detail Full AI analysis (login) enituretechnology CWE-89