CVE-2025-1702
Published: 05 March 2025
Summary
CVE-2025-1702 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Ultimate Member plugin for WordPress, which handles user profiles, registration, login, member directories, and related membership features, contains a time-based SQL injection vulnerability. The flaw exists in all versions through 2.10.0 and stems from insufficient escaping of the user-supplied "search" parameter combined with an unprepared SQL query in the member directory component. This allows crafted input to alter query logic and potentially leak database contents, as reflected in its CVSS 7.5 rating for high confidentiality impact without authentication or user interaction.
Unauthenticated attackers can exploit the issue remotely by supplying malicious values to the search parameter in directory or listing requests. Successful exploitation enables appending additional SQL statements to existing queries, permitting extraction of sensitive information such as user credentials or other stored data from the WordPress database.
Public references include a GitHub commit that addresses the parameter handling, along with WordPress plugin repository changesets and source file listings that document the vulnerable code paths in class-member-directory.php. Mitigation consists of applying the referenced patch or upgrading to a corrected release of the plugin.
The EPSS score rose from a low baseline to a peak of 0.0217 in early 2026 before receding, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6085
Vulnerability details
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping…
more
on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated SQL injection in a public-facing WordPress plugin that directly enables exploitation of the web application (T1190) and facilitates extraction of sensitive data including credentials from the backend database (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied 'search' parameter to prevent time-based SQL injection by ensuring insufficient escaping and preparation issues are addressed.
Mandates identification, reporting, and correction of flaws like the unescaped 'search' parameter in the Ultimate Member plugin's SQL queries via patching to versions beyond 2.10.0.
Enables vulnerability scanning to detect SQL injection flaws in web plugins like Ultimate Member and supports timely remediation.