Atomic Edge analysis of CVE-2025-69304 (metadata-based):
This vulnerability is an unauthenticated SQL injection in the Allmart WordPress plugin, version 1.1. The flaw exists in a plugin component that processes user-supplied parameters without proper sanitization. Attackers can exploit this to execute arbitrary SQL commands, leading to data extraction. The CVSS score of 7.5 (High) reflects a network-accessible attack with no authentication or user interaction required, resulting in high confidentiality impact.

Atomic Edge research infers the root cause is improper neutralization of special elements in an SQL command (CWE-89). The description states insufficient escaping and lack of sufficient preparation on an existing SQL query. This indicates the plugin likely constructs SQL queries by directly concatenating unsanitized user input. The vulnerable code path is not confirmed via source code review, but the CWE classification strongly suggests the use of `$wpdb->query()` or similar methods without parameterized statements or proper use of `$wpdb->prepare()`.

Exploitation likely occurs via a public-facing WordPress hook. Common vectors for unauthenticated SQL injection in plugins include AJAX endpoints registered with `wp_ajax_nopriv_` or REST API endpoints. Given the plugin slug ‘allmart-core’, a probable attack vector is a POST or GET request to `/wp-admin/admin-ajax.php` with an `action` parameter like `allmart_core_action`. The malicious SQL payload would be supplied in another parameter, such as `id` or `slug`. Attackers can use UNION-based or time-based blind SQL injection techniques to extract data from the WordPress database.

Effective remediation requires implementing proper input validation and using parameterized queries. The fix should replace direct string concatenation in SQL statements with the WordPress `$wpdb->prepare()` function. All user-supplied variables must be passed as parameters to this function. Alternatively, using higher-level `$wpdb` methods like `$wpdb->get_row()` with prepared statements would also neutralize the threat. Input validation should verify expected data types (e.g., integers) before database operations.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the database. This includes WordPress user credentials (hashed passwords), personally identifiable information, and other private site data stored in plugin-specific tables. While the CVSS vector indicates no direct impact on integrity or availability (I:N/A:N), the complete compromise of database confidentiality can facilitate further attacks, such as password cracking or session hijacking.