CVE-2025-5287

Deeper analysis

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to and including 1.0.0. The issue stems from insufficient escaping of user-supplied input and the absence of prepared statements on an existing SQL query, as identified under CWE-89. This flaw affects the plugin component hosted at plugins.trac.wordpress.org and carries a CVSS 3.1 score of 7.5 with network attack vector and high confidentiality impact.

Unauthenticated attackers can exploit the vulnerability remotely by supplying crafted input to the 'post' parameter, allowing them to append additional SQL queries to existing database operations and extract sensitive information. No authentication or user interaction is required, enabling direct access to database contents through the WordPress installation.

The EPSS score for this CVE rose from a low baseline to a peak of 0.1924 with a current value of 0.1001, indicating emerging exploitation interest after public disclosure. References point to the vulnerable code path in the plugin's main file and a detailed entry from Wordfence threat intelligence, though no explicit patch or mitigation statements are detailed in the provided sources.