CVE-2025-13192

High

Published: 05 February 2026

Published

05 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0040 31.6th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-13192 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-13192 is a generic SQL injection vulnerability affecting the Popup Builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress in all versions up to and including 2.2.0. The flaw exists in multiple REST API endpoints due to insufficient escaping of user-supplied parameters and lack of sufficient preparation on existing SQL queries, enabling attackers to append malicious SQL queries.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction required. Successful exploitation allows extraction of sensitive information from the database, resulting in high confidentiality impact, low integrity impact, and no availability impact, as scored at CVSS v3.1 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and mapped to CWE-89.

The vulnerability was patched in plugin version 2.2.1 for unauthenticated users and fully mitigated in version 2.2.3 for Administrator-level users and above. Code references in the WordPress plugin trac repository detail the vulnerable locations, including lines in includes/Helpers/DataBase.php and includes/Routes/Popup.php and Subscribers.php files.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-206858

Vulnerability details

The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Injection via the multiple REST API endpoints in all versions up to, and including, 2.2.0 due to insufficient escaping on…

the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Vulnerability was patched in version 2.2.1 for unauthenticated users, and fully patched in version 2.2.3 for Administrator+ level users.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in public WordPress REST endpoints directly enables remote unauthenticated exploitation of a public-facing web application for database data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0