Cyber Resilience

CVE-2026-25378

High

Published: 19 February 2026

Published
19 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0001 3.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25378 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-25378 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the Nelio AB Testing WordPress plugin developed by Nelio Software. Published on 2026-02-19, it affects all versions of the plugin from n/a through 8.2.4 and is associated with CWE-89.

The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating exploitation over the network with low complexity, no user interaction required, but necessitating high privileges such as those of an authenticated administrator. A privileged attacker can leverage the blind SQL injection to extract sensitive data from the database, achieving high confidentiality impact due to the changed scope, alongside a low availability impact.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/nelio-ab-testing/vulnerability/wordpress-nelio-ab-testing-plugin-8-2-4-sql-injection-vulnerability?_s_id=cve details the SQL injection vulnerability specific to the Nelio AB Testing WordPress plugin version 8.2.4.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing WordPress plugin directly enables T1190 for network-based exploitation of the web app; blind SQLi for DB data extraction maps to T1213.006 (Databases) under Collection, matching the described high confidentiality impact via crafted queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2019-25537Shared CWE-89
CVE-2019-25366Shared CWE-89
CVE-2019-25496Shared CWE-89
CVE-2026-1475Shared CWE-89
CVE-2026-26990Shared CWE-89
CVE-2026-44047Shared CWE-89
CVE-2025-12865Shared CWE-89
CVE-2024-11135Shared CWE-89
CVE-2019-25491Shared CWE-89
CVE-2024-13369Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mandates validation of information inputs to neutralize special elements used in SQL commands, preventing blind SQL injection exploitation as in CVE-2026-25378.

SI-2 Flaw Remediation good match
prevent

Requires organizations to identify, report, and correct flaws like the SQL injection vulnerability in Nelio AB Testing plugin versions through <=8.2.4 via timely patching.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables vulnerability scanning and monitoring to identify SQL injection flaws such as CVE-2026-25378 in WordPress plugins, supporting proactive remediation.

References