CVE-2025-25112
Published: 03 March 2025
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2025-25112 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as SQL Injection (CWE-89), in the Social Links WordPress plugin developed by kareemsultan (slug: social-links). This flaw allows command line execution through SQL Injection and affects all versions from n/a through 1.2 inclusive. The vulnerability was published on 2025-03-03 with a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L).
The attack requires high privileges (PR:H), such as those of an authenticated WordPress user with elevated access, but can be carried out remotely over the network with low attack complexity and no user interaction. Attackers can exploit the SQL Injection to execute arbitrary commands on the server, resulting in high confidentiality impact through data exfiltration, a change in scope to cross-component effects, and low availability disruption.
Patchstack documents this vulnerability in their database, providing further details via the reference at https://patchstack.com/database/Wordpress/Plugin/social-links/vulnerability/wordpress-links-in-captions-plugin-1-2-stored-cross-site-scripting-xss-vulnerability-2?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL Injection in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) and arbitrary command line execution via Unix shell (T1059.004).