CVE-2025-23931

Critical

Published: 22 January 2025

Published

22 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0009 26.4th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23931 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-23931 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the WordPress plugin Local SEO (dh-local-seo) by Oliver Fuhrmann. The flaw affects all versions of the plugin from n/a through 2.3 inclusive.

With a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), the vulnerability is exploitable over the network by unauthenticated remote attackers requiring low complexity and no user interaction. Attackers can achieve high confidentiality impact by extracting sensitive data from the database through blind SQL injection techniques, alongside low availability impact and changed scope, but without integrity impact.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/dh-local-seo/vulnerability/wordpress-wordpress-local-seo-plugin-2-3-sql-injection-vulnerability?_s_id=cve documents this SQL injection vulnerability in the WordPress Local SEO plugin version 2.3. Practitioners should review the advisory for specific mitigation recommendations.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3546

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing WordPress plugin directly enables remote exploitation of public-facing applications (T1190) and facilitates extraction of sensitive data from the database via blind SQL queries (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0