EUVD-2025-17244
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress allows SQL Injection. This issue affects Store Locator WordPress: from n/a through 1.5.1.
AnalysisAI
SQL injection vulnerability in Agile Logix Store Locator WordPress plugin (versions up to 1.5.1) that allows authenticated attackers with high privileges to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.6 with high confidentiality impact and limited availability impact, though it requires administrative-level privileges to exploit. The scope is changed, indicating potential impact beyond the vulnerable component itself.
Technical ContextAI
This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command - SQL Injection), a fundamental input validation flaw in database query construction. The Agile Logix Store Locator WordPress plugin fails to properly sanitize and parameterize user-supplied input before incorporating it into SQL queries. The affected technology is WordPress plugin architecture running on PHP with WordPress database abstraction layers. The vulnerability exists in the Store Locator plugin specifically designed for location-based search functionality, likely in database query handling for store filtering, searching, or location queries. The lack of prepared statements or proper input escaping allows attackers to break out of intended SQL syntax and inject arbitrary commands.
RemediationAI
Immediate actions: (1) Update the Store Locator plugin to version 1.5.2 or later once released by Agile Logix (monitor official plugin repository); (2) Restrict WordPress administrator account access to trusted users only, implementing principle of least privilege; (3) Implement WordPress user role management to limit database query capability; (4) Disable the Store Locator plugin if not actively used until patching is available. Long-term mitigations: (1) Apply prepared statements/parameterized queries in plugin code using WordPress $wpdb->prepare(); (2) Implement input validation and sanitization using WordPress sanitization functions (sanitize_text_field, sanitize_sql_orderby); (3) Add Web Application Firewall (WAF) rules to detect SQL injection patterns in Store Locator queries; (4) Enable WordPress security audit logging to monitor database queries from administrative functions.
Share
External POC / Exploit Code
Leaving vuln.today