CVE-2025-1323
Published: 08 March 2025
Summary
CVE-2025-1323 is a high-severity SQL Injection (CWE-89) vulnerability in Plechevandrey Wp-Recall. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The WP-Recall plugin for WordPress, which provides registration, profile, commerce, and related functionality, contains a SQL injection vulnerability in all versions through 16.26.10. The flaw exists in the handling of the 'databeat' parameter, where insufficient escaping of user input and the absence of prepared statements allow an attacker to modify existing database queries.
Unauthenticated attackers can exploit the issue over the network by supplying crafted input that appends additional SQL statements, enabling extraction of sensitive data from the WordPress database. The vulnerability carries a CVSS 3.1 score of 7.5, reflecting its remote exploitability without authentication or user interaction and its impact on confidentiality.
A patch addressing the parameter handling was committed to the plugin's repository, and Wordfence published corresponding threat intelligence. Administrators should update to a fixed version once released and apply standard WordPress plugin hygiene such as restricting unnecessary database exposure.
The EPSS score rose from a low baseline to a peak of 0.5321 on 2025-12-11 before receding to 0.2862, indicating increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7391
Vulnerability details
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of…
more
sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation (T1190) and directly facilitates database data extraction (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by requiring validation and sanitization of user-supplied parameters like 'databeat' before incorporation into SQL queries.
Ensures timely identification, reporting, and patching of flaws such as the SQL injection vulnerability in the WP-Recall plugin up to version 16.26.10.
Boundary protection with web application firewalls can inspect and block malicious SQL injection payloads targeting the vulnerable 'databeat' parameter.