Custom 404 Pro CVE-2025-9947

Exploitation requires an authenticated session with WordPress Administrator-level access or above (PR:H) and reaches the vulnerable 'path' parameter processed by the plugin's admin Helpers.php logic; the Custom 404 Pro plugin (version 3.12.0 or earlier) must be installed and active. The dominant limiting factor is the administrator privilege prerequisite, which both restricts the attacker population to already-highly-trusted accounts and reduces real-world value, since an administrator generally already has broad data access. No end-user interaction is needed (UI:N), and impact is limited to confidentiality via blind/time-based extraction; it does not modify data or affect availability.

This is a comparatively low-priority issue despite the CRITICAL-sounding CWE-89 (SQL Injection) label. The CVSS 3.1 base score is only 4.9 (Medium), driven entirely by the high privilege requirement: the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms network reach and low complexity but requires PR:H - the description specifies Administrator-level access or above. An actor who already holds WordPress admin can typically read the database or install arbitrary code through legitimate functionality, so this SQLi offers marginal additional capability and is best characterized as a defense-in-depth/post-compromise concern rather than an initial-access vector. The EPSS score of 0.30% (20th percentile) corroborates low expected exploitation, and the issue is NOT in CISA KEV, so there is no evidence of active exploitation. No public exploit code was identified in the provided data. The only impact is confidentiality (C:H); integrity and availability are unaffected (I:N/A:N), consistent with a time-based extraction technique. Signals are internally consistent - high-privilege, network, medium severity, low EPSS, no KEV, no POC - with no contradictions requiring vendor verification.

An attacker who has already obtained WordPress Administrator credentials (via phishing, credential reuse, or a prior compromise) submits a crafted value in the 'path' parameter handled by the plugin's admin helper, appending a time-based blind SQL payload to an existing query. By observing response delays, they incrementally extract sensitive data such as user password hashes or secret keys from the database. No public proof-of-concept exploit was identified at the time of analysis.