Cyber Resilience

CVE-2025-9587

High

Published: 02 October 2025

Published
02 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0011 28.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9587 is a high-severity an unspecified weakness vulnerability. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-9587 is a SQL injection vulnerability in the CTL Behance Importer Lite WordPress plugin through version 1.0. The flaw arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement via an AJAX action that is accessible to unauthenticated users.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Successful exploitation allows attackers to extract sensitive data from the database, achieving high confidentiality impact due to the cross-scope nature of the attack.

The WPScan advisory at https://wpscan.com/vulnerability/e497f8b3-d70b-4d81-b915-e78ea5c02863/ provides detailed information on the vulnerability.

EU & UK References

Vulnerability details

The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in publicly accessible WordPress plugin directly enables remote unauthenticated exploitation of a web application for database data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation and sanitization of untrusted inputs before use in SQL statements, directly preventing the SQL injection vulnerability in CVE-2025-9587.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and remediation of software flaws like the unsanitized AJAX parameter in the CTL Behance Importer Lite plugin.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables vulnerability scanning to identify SQL injection flaws in WordPress plugins such as CVE-2025-9587 prior to exploitation.

References