CVE-2025-23774
Published: 22 January 2025
Summary
CVE-2025-23774 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information Output Filtering directly prevents the insertion of sensitive data into transmitted responses by filtering outputs prior to transmission.
Flaw Remediation requires timely patching of the vulnerable WPDB to Sql plugin to eliminate the sensitive data exposure vulnerability.
Monitoring for Information Disclosure enables detection of unauthorized sensitive data leaks in transmitted data from the plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sensitive data exposure in public-facing WordPress plugin enables remote collection of confidential data from local system (T1005) via exploitation of public-facing app (T1190).
NVD Description
Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through <= 1.2.
Deeper analysisAI
CVE-2025-23774 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in the WPDB to Sql WordPress plugin developed by Niket Joshi. This issue affects all versions of the wpdb-to-sql plugin up to and including 1.2, enabling attackers to retrieve embedded sensitive data that is inadvertently included in transmitted data.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it can be exploited over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation allows remote attackers to obtain high-impact confidential information, such as sensitive data embedded in responses, without impacting integrity or availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wpdb-to-sql/vulnerability/wordpress-wpdb-to-sql-plugin-1-2-sensitive-data-exposure-vulnerability?_s_id=cve) documents this sensitive data exposure vulnerability in the WPDB to Sql plugin version 1.2. Security practitioners should consult the advisory for specific mitigation recommendations, such as applying available patches or updates.
Details
- CWE(s)