WP Pipes CVE-2025-28982

No special conditions required - remote unauthenticated exploitation against default WordPress installations running WP Pipes versions through 1.4.3. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction needed. Exploitation requires only network access to the WordPress site and knowledge of the vulnerable plugin endpoint, which can be identified through standard WordPress plugin enumeration techniques or Wappalyzer-style fingerprinting. The primary limiting factor is deployment prevalence: organizations not using WP Pipes are unaffected regardless of their WordPress version. Sites with the plugin installed but inactive may still be vulnerable if plugin code is loaded during WordPress initialization.

CVSS 9.3 reflects maximum severity due to the attack vector being network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and changed scope (S:C) with high confidentiality impact and low availability impact. However, multiple signals suggest lower real-world urgency: EPSS score of 0.06% (19th percentile) indicates extremely low probability of exploitation in the wild within 30 days, with no evidence of widespread attacker interest. No CISA KEV listing confirms this is not being actively exploited in observed attacks against critical infrastructure or enterprise targets. The vulnerability was responsibly disclosed through Patchstack's audit channel rather than discovered through active exploitation. The primary risk is confidential data exposure (C:H) including WordPress credentials, user PII, and application secrets, with secondary availability impact (A:L) from potential database denial-of-service through resource-intensive queries. Organizations running WP Pipes should prioritize remediation based on the sensitivity of data in their WordPress database and whether the plugin is actively used, rather than treating this as an emergency patch requiring immediate out-of-band deployment. The combination of high theoretical severity but low observed exploitation makes this a scheduled maintenance priority rather than a crisis response.

An unauthenticated remote attacker identifies a WordPress site running WP Pipes 1.4.3 through automated scanning or plugin enumeration. The attacker crafts malicious HTTP requests containing SQL injection payloads targeting vulnerable input parameters in the plugin's data processing functions. Successfully injected SQL commands extract the entire wp_users table containing administrator credentials, user email addresses, and password hashes, enabling subsequent account takeover. Advanced exploitation includes UNION-based queries to enumerate database schema, extract sensitive post content, or execute stored procedures if database permissions allow, potentially leading to complete WordPress site compromise.