EUVD-2025-17500
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages allows Blind SQL Injection. This issue affects WP Lead Capturing Pages: from n/a through 2.3.
AnalysisAI
Blind SQL Injection vulnerability in the WP Lead Capturing Pages WordPress plugin (versions through 2.3) that allows unauthenticated remote attackers to extract sensitive data from the database without leaving obvious traces. The vulnerability has a critical CVSS score of 9.3 due to its network-accessible attack vector, low complexity, and requirement for no privileges or user interaction. While specific KEV or active exploitation status is not confirmed in available intelligence, the high CVSS, blind SQL injection nature, and broad applicability across WordPress installations make this a priority for remediation.
Technical ContextAI
This vulnerability exploits improper input sanitization in the WP Lead Capturing Pages plugin (CPE: wp:wp-lead-capturing-pages or vendor-specific WordPress plugin identifier), a WordPress plugin used for lead capture functionality. The root cause is CWE-89 (SQL Injection), where user-controlled input is directly concatenated into SQL queries without proper parameterized queries or escaping. Blind SQL injection specifically allows attackers to infer database structure and content through time-based or boolean-based inference techniques (observing response timing differences or true/false conditions), rather than direct error-based feedback. WordPress plugins are executed with database privileges in the hosting environment, making them a high-value target for data extraction attacks.
RemediationAI
patch: Update WP Lead Capturing Pages plugin to version 2.4 or later (version details to be confirmed from vendor advisory); priority: immediate workaround: If immediate patching is not possible, disable the WP Lead Capturing Pages plugin and remove from active plugins list until patched version is available mitigation: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests, specifically blind SQL injection signatures (time-based delays, conditional responses) detection: Monitor database query logs and web server access logs for suspicious patterns: unusual sleep() or BENCHMARK() statements, IF() conditions, OR 1=1 patterns, and time-based response anomalies mitigation: Restrict database user privileges used by WordPress to only necessary permissions; avoid using database admin credentials for WordPress connection
Share
External POC / Exploit Code
Leaving vuln.today