CVE-2025-43833 HIGH

CVE-2025-43833: WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability

Vendor Amir Helzer
Product Absolute Links
Weakness CWE-89 · SQLi
Published May 19, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.

Explanation of Vulnerability in Simple Terms

02Summary

Absolute Links versions 1.1.1 and earlier contain a SQL injection vulnerability accessible to high-privilege users. An attacker with administrative access can inject malicious SQL commands through the plugin, potentially reading sensitive database information and disrupting site availability. The vulnerability requires high-level privileges to exploit.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the site database and cause service disruptions.

Potential impact on your site

04Site Impact

An admin account compromise could expose your database contents and cause downtime.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the site.

Key dates

06Disclosure timeline

May 19, 2025 CVE published
April 28, 2026 Record updated