CVE-2025-31547
Published: 31 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-31547 is an SQL Injection vulnerability (CWE-89) in the Aphotrax Uptime Robot Plugin for WordPress, specifically the uptime-robot-monitor component. Published on 2025-03-31, it stems from improper neutralization of special elements used in an SQL command. The issue affects all versions of the plugin up to and including 2.3.
The vulnerability has a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating high severity due to network accessibility, low attack complexity, and low required privileges. An attacker with low-privileged access, such as a subscribed WordPress user, can exploit it remotely without user interaction. Successful exploitation allows high-impact confidentiality breaches, such as extracting sensitive data from the database, with low impact on integrity and availability, and scope change to the database server.
Patchstack has documented the vulnerability in its database, providing details on the affected WordPress plugin version 2.3 SQL Injection issue at https://patchstack.com/database/Wordpress/Plugin/uptime-robot-monitor/vulnerability/wordpress-uptime-robot-plugin-for-wordpress-plugin-2-3-sql-injection-vulnerability?_s_id=cve. Security practitioners should check this advisory for mitigation guidance, such as updating to a patched version if available or applying input sanitization workarounds.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote exploitation of the web application by low-privileged authenticated users for unauthorized database data extraction.