CVE-2025-24587
Published: 24 January 2025
Summary
CVE-2025-24587 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates blind SQL injection in the Nks Email Subscription Popup plugin by requiring validation and sanitization of user-supplied inputs used in SQL queries.
Addresses the specific flaw in plugin versions up to 1.2.23 by requiring identification, reporting, and timely patching to eliminate the SQL injection vulnerability.
Enables vulnerability scanning to identify SQL injection flaws like CVE-2025-24587 in WordPress plugins prior to exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The blind SQL injection vulnerability directly enables querying and exfiltrating data from the WordPress database (information repository), mapping to T1213.006 Databases.
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
Deeper analysisAI
CVE-2025-24587 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as Blind SQL Injection (CWE-89), affecting the Nks Email Subscription Popup (email-subscribe) WordPress plugin. This flaw impacts all versions of the plugin up to and including 1.2.23. The vulnerability arises from inadequate sanitization of user inputs in SQL queries, enabling attackers to manipulate database operations.
Exploitation requires high privileges (PR:H), such as those held by an authenticated WordPress administrator, and can be performed over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful attacks result in a scope change (S:C), granting high confidentiality impact (C:H) through data exfiltration via blind SQL injection techniques, alongside low availability impact (A:L) and no integrity impact (I:N). The overall CVSS v3.1 base score is 7.6 (High), highlighting the risk to sensitive subscriber data or other database contents in affected installations.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-23-sql-injection-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 1.2.23 or applying available security configurations for the plugin.
Details
- CWE(s)