What is the CVSS score of CVE-2025-6718?

CVE-2025-6718 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-6718?

The B1.lt WordPress plugin (versions ≤2.2.57) contains a SQL injection vulnerability that allows any subscriber-level user to execute arbitrary database commands, effectively granting database-level…

How to fix or mitigate CVE-2025-6718?

Within 24 hours: Disable the B1.lt WordPress plugin immediately and audit all subscriber and contributor accounts for unauthorized activity. Within 7 days: Review database access logs for suspicious queries executed via the b1_run_query AJAX action; contact plugin vendor for patch timeline or consider permanent replacement with an alternative solution. Within 30 days: Implement Web Application Firewall (WAF) rules to block AJAX requests to b1_run_query from non-administrator users; upgrade to a patched version when available or migrate to an alternative plugin with equivalent functionality.

WordPress CVE-2025-6718

HIGH

Missing Authorization (CWE-862)

2025-07-18 security@wordfence.com

Authentication Bypass WordPress SQLi

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 18, 2025 - 06:15 nvd

HIGH 8.8

DescriptionCVE.org

The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands.

AnalysisAI

SQL injection in the B1.lt WordPress plugin (versions ≤2.2.57) allows authenticated users with Subscriber-level privileges to execute arbitrary database commands via the b1_run_query AJAX action. The vulnerability stems from a missing capability check (CWE-862), enabling low-privileged authenticated attackers to access database functionality normally restricted to administrators. With CVSS 8.8 (network-accessible, low complexity, high impact on confidentiality/integrity/availability) and successful exploitation requiring only subscriber credentials, this represents a critical privilege escalation vector. No public exploit identified at time of analysis, though the technical details disclosed increase weaponization risk.

Technical ContextAI

This vulnerability exploits WordPress's AJAX action handler mechanism. The B1.lt plugin registers an AJAX endpoint (b1_run_query) that directly executes SQL queries against the WordPress database without validating whether the authenticated user has administrative privileges. The root cause is CWE-862 (Missing Authorization), where the plugin fails to implement WordPress's capability checking functions (like current_user_can) before processing database operations. WordPress operates on a role-based access control model where Subscribers (the lowest authenticated role) typically have minimal permissions. This flaw bypasses that security boundary, allowing any authenticated user to invoke database query functionality. The CVSS vector PR:L confirms low-privileged authentication is required, while AV:N/AC:L indicates network-accessible exploitation with minimal complexity. The plugin appears to be B1 Accounting integration software for WordPress, exposing database operations through insufficiently protected AJAX handlers.

Affected ProductsAI

The B1.lt (B1 Accounting) plugin for WordPress is affected in all versions up to and including 2.2.57. This plugin integrates B1 accounting software with WordPress installations and is available through the official WordPress plugin repository at wordpress.org/plugins/b1-accounting. The vulnerability impacts any WordPress site running the affected plugin versions where authenticated user registration is enabled or where attacker-controlled Subscriber accounts exist. Based on the WordPress Trac references, the vendor has committed fixes in changesets 3329617 and 3338792, indicating patches have been developed for the vulnerable code paths.

RemediationAI

Immediately update the B1.lt plugin to version 2.2.58 or later, which addresses the missing capability check vulnerability. The vendor has released fixes documented in WordPress plugin repository changesets 3329617 and 3338792 available at plugins.trac.wordpress.org. Site administrators should verify the installed plugin version via WordPress admin dashboard and apply updates through the standard WordPress plugin update mechanism. As interim mitigation if patching is delayed, restrict user registration to prevent attacker-controlled Subscriber account creation, audit existing low-privileged user accounts for suspicious activity, review database logs for unauthorized SQL execution patterns, and consider temporarily disabling the B1.lt plugin if not actively required for business operations. Post-remediation, conduct database integrity checks to ensure no unauthorized modifications occurred during the vulnerability window. Additional security guidance is available from Wordfence Threat Intelligence at wordfence.com/threat-intel/vulnerabilities/id/4e479a3f-ef1a-4476-89e1-86d0f388f2c3.