CVE-2025-24587

CVE-2025-24587 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as Blind SQL Injection (CWE-89), affecting the Nks Email Subscription Popup (email-subscribe) WordPress plugin. This flaw impacts all versions of the plugin up to and including 1.2.23. The vulnerability arises from inadequate sanitization of user inputs in SQL queries, enabling attackers to manipulate database operations.

Exploitation requires high privileges (PR:H), such as those held by an authenticated WordPress administrator, and can be performed over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful attacks result in a scope change (S:C), granting high confidentiality impact (C:H) through data exfiltration via blind SQL injection techniques, alongside low availability impact (A:L) and no integrity impact (I:N). The overall CVSS v3.1 base score is 7.6 (High), highlighting the risk to sensitive subscriber data or other database contents in affected installations.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-23-sql-injection-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 1.2.23 or applying available security configurations for the plugin.