CVE-2025-24728
Published: 24 January 2025
Summary
CVE-2025-24728 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the blind SQL injection vulnerability in the Bug Library WordPress plugin by identifying, reporting, and applying patches up to version 2.1.4.
Prevents exploitation of the improper neutralization of special elements in SQL commands by enforcing validation of information inputs to the plugin.
Detects the SQL injection vulnerability through systematic vulnerability scanning of the WordPress plugin and hosted applications.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin allows authenticated low-priv users to extract DB data (high C impact, scope change), directly enabling public app exploitation (T1190), priv esc (T1068), and DB info repo access (T1213.006).
NVD Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4.
Deeper analysisAI
CVE-2025-24728 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as SQL Injection (CWE-89), specifically enabling Blind SQL Injection in the Bug Library WordPress plugin developed by Yannick Lefebvre. This issue affects all versions of the plugin from unknown initial release through 2.1.4.
The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating it can be exploited over the network with low attack complexity by users possessing low privileges, such as authenticated low-level WordPress users, without requiring user interaction. Successful exploitation changes the scope, allowing high-impact confidentiality violations through data extraction via blind SQL injection techniques, with no integrity impact and only low availability disruption.
Details on mitigation, including patches for the WordPress Bug Library plugin vulnerability up to version 2.1.4, are provided in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/bug-library/vulnerability/wordpress-bug-library-plugin-2-1-4-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)