CVE-2025-39474 is a critical SQL injection flaw (CVSS 9.3) in the ThemeMove Amely WordPress theme, in versions up to and including 3.1.4. Patchstack lists 3.2.0 as the patched version. Update to 3.2.0 or later on every site that uses the theme, and replace it if you cannot update.
What's affected
The record names the ThemeMove Amely theme, from n/a through 3.1.4, and describes improper neutralization of special elements used in an SQL command.
Patchstack's page for this entry lists 3.1.4 and earlier as vulnerable and 3.2.0 as the patched version. Its advice is to update to 3.2.0 or later. The record itself gives only the affected range, so confirm the fixed version in the theme's own changelog as well.
The record lists the weakness as CWE-89 (SQL injection). The CVSS 3.1 score is 9.3 (critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated high, integrity no and availability low.
The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Patchstack's page rates the issue as high priority and expects it to be exploited at scale, which is a forecast and not a report of attacks. Treat internet facing sites as the priority.
How to check if you're exposed
Check each WordPress install for the theme and its version.
- With WP-CLI, list the theme and its version on each site:
wp theme list --fields=name,status,version | grep -i amely
- Without WP-CLI, open the Themes page in the dashboard and read the version under Amely. Compare it with 3.1.4, the last affected version in the record.
- Look for version 3.2.0 or later, the patched version listed by Patchstack.
- Remember that an inactive theme or plugin can still be reachable on disk. Check the folder under wp-content as well, and delete anything you do not use.
If you manage many sites, the free in-browser dependency scan covers application dependencies, and the Gold directory lets you look up other CVEs by product. Themes and plugins still need to be checked on each site.
What to do now
- Update the Amely theme to 3.2.0 or later on every site, then clear caches.
- If you use a child theme, test it after the update, because parent theme changes can affect overrides.
- If you cannot update today, switch to another theme or restrict access to the site until you can.
- Review database users for new administrator accounts, and review recent changes to content and options.
- Use a database account for WordPress that has only the permissions it needs.
- Turn on a web application firewall and keep access logs long enough to review after the update.
Why it matters
SQL injection lets input from a request change the query the database runs. In a WordPress theme, that can expose user records, change settings or add accounts, depending on where the query sits. The record lists CWE-89 and a score of 9.3, which reflects the wide reach of a flaw in a component that runs on every page load or request.
Themes often include shop, search and filter features that talk to the database directly. Each of those is a place where input must be handled carefully. Updating is the real fix. A firewall rule can buy time, but it is a filter on known patterns and is not a substitute for the patched code.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-39474?
Patchstack lists 3.2.0 as the patched version. The record covers versions through 3.1.4, so any version below 3.2.0 should be updated.
Is it exploited in the wild?
The record does not say so and the CISA Known Exploited Vulnerabilities flag is false. Patchstack describes the issue as high priority, so update soon.
Sources
- Gold entry for CVE-2025-39474
- NVD record for CVE-2025-39474, published 2025-06-27, as summarized above
- Patchstack entry for Amely 3.1.4
Last reviewed: 18 October 2026.
