CVE-2025-24587
Published: 24 January 2025
Summary
CVE-2025-24587 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24587 is a blind SQL injection vulnerability arising from improper neutralization of special elements in SQL commands. It affects the email-subscribe component of the Nks Email Subscription Popup WordPress plugin, impacting all versions through 1.2.23.
An authenticated attacker with high privileges can exploit the flaw over the network to perform blind SQL injection. Successful exploitation yields high impact to confidentiality and limited impact to availability within a changed security scope, as reflected in the CVSS 7.6 rating.
The single reference advisory from Patchstack documents the issue specifically for the WordPress Email Subscription Popup plugin at version 1.2.23 and provides associated vulnerability tracking details.
The EPSS score shows a trajectory from a low starting point to a recorded peak of 0.1468 (current value 0.1192), indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3791
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The blind SQL injection vulnerability directly enables querying and exfiltrating data from the WordPress database (information repository), mapping to T1213.006 Databases.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates blind SQL injection in the Nks Email Subscription Popup plugin by requiring validation and sanitization of user-supplied inputs used in SQL queries.
Addresses the specific flaw in plugin versions up to 1.2.23 by requiring identification, reporting, and timely patching to eliminate the SQL injection vulnerability.
Enables vulnerability scanning to identify SQL injection flaws like CVE-2025-24587 in WordPress plugins prior to exploitation.