CVE-2025-0861
Published: 30 January 2025
Description
The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Security Summary
CVE-2025-0861 is a SQL injection vulnerability (CWE-89) in the VR-Frases (collect & share quotes) plugin for WordPress, affecting all versions up to and including 3.0.1. The issue stems from insufficient escaping of user-supplied parameters and lack of sufficient preparation in existing SQL queries, impacting several parameters in the plugin's code.
Unauthenticated attackers can exploit the vulnerability by appending additional SQL queries to existing ones, allowing extraction of sensitive information from the database. The CVSS v3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact over the network with low attack complexity but high privileges required.
Mitigation details are referenced in advisories including the plugin source code at https://plugins.svn.wordpress.org/vr-frases/tags/3.0.1/includes/vr-frases-admin.php, a changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3278561%40vr-frases&new=3278561%40vr-frases&sfp_email=&sfph_mail=, and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9d5afb-d38d-442c-8511-f1683739a1da?source=cve. The vulnerability was published on 2025-01-30.
Details
- CWE(s)