CVE-2025-28983 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: ClickandPledge. 📦 **Product**: Click & Pledge Connect. 📅 **Affected Versions**: WordPress **6.8** and earlier versions. ⚠️ If you are on 6.8 or below, you are vulnerable.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🌐 **Vector**: Network (AV:N). 🔑 **Auth**: None required (PR:N). 👀 **UI**: None required (UI:N). ✅ **Ease**: Easy to exploit remotely without authentication.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No** specific PoC provided in the data (pocs: []). 🌍 **Wild Exploitation**: Likely possible due to low complexity (AC:L) and no auth requirement. Treat as **active threat**.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check WordPress Plugin list for **Click & Pledge Connect**. 2. Verify version is **≤ 6.8**. 3. Scan for SQLi patterns in plugin endpoints. 🛠️ Use automated scanners targeting CWE-89.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix Status**: Patch available via vendor. 🔗 **Reference**: Patchstack database entry confirms fix. ✅ **Action**: Update plugin to the latest version immediately. Official patch exists.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 📊 **CVSS**: High (H/H/H). 🚀 **Priority**: **Immediate Action Required**. 📢 Deploy patch or disable plugin NOW to prevent privilege escalation attacks.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in Click & Pledge Connect plugin. <br>💥 **Consequences**: Attackers can manipulate database queries, leading to **Privilege Escalation** and full system compromise.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (Improper Neutralization of Special Elements used in an SQL Command).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: ClickandPledge. <br>📦 **Product**: Click & Pledge Connect. <br>📅 **Affected Versions**: WordPress **6.8** and earlier versions. ⚠️ If you are on 6.8 or below, you are vulnerable.

Q4What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: <br>1. **Escalate Privileges**: Gain admin access. <br>2. **Steal Data**: Extract sensitive database info. <br>3. **Modify Content**: Alter site data.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🌐 **Vector**: Network (AV:N). <br>🔑 **Auth**: None required (PR:N). <br>👀 **UI**: None required (UI:N). <br>✅ **Ease**: Easy to exploit remotely without authentication.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No** specific PoC provided in the data (pocs: []). <br>🌍 **Wild Exploitation**: Likely possible due to low complexity (AC:L) and no auth requirement. Treat as **active threat**.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Check WordPress Plugin list for **Click & Pledge Connect**. <br>2. Verify version is **≤ 6.8**. <br>3. Scan for SQLi patterns in plugin endpoints. <br>🛠️ Use automated scanners targeting CWE-89.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix Status**: Patch available via vendor. <br>🔗 **Reference**: Patchstack database entry confirms fix. <br>✅ **Action**: Update plugin to the latest version immediately. Official patch exists.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Disable** the plugin if not essential. <br>2. **Restrict Access**: Limit plugin functionality via firewall rules. <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>📊 **CVSS**: High (H/H/H). <br>🚀 **Priority**: **Immediate Action Required**. <br>📢 Deploy patch or disable plugin NOW to prevent privilege escalation attacks.

Continue exploring

Vulnerability detail Full AI analysis (login) ClickandPledge CWE-89