CVE-2025-10175: WP Links Page Plugin SQL Injection Flaw

CVE-2025-10175 Overview

The WP Links Page plugin for WordPress contains a SQL Injection vulnerability affecting all versions up to and including 4.9.6. The flaw resides in handling of the id parameter, which is not properly escaped before being concatenated into a SQL query. Authenticated attackers with Subscriber-level access or above can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials, session tokens, and configuration data. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated users with minimal privileges can exfiltrate arbitrary data from the WordPress database, including password hashes and administrative secrets.

Affected Products

WP Links Page plugin for WordPress, versions up to and including 4.9.6
WordPress installations with Subscriber-level or higher user registration enabled
Any site distributing the vulnerable plugin from the WordPress Plugin Directory

Discovery Timeline

2025-10-11 - CVE-2025-10175 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10175

Vulnerability Analysis

The vulnerability originates in the plugin's query construction logic within wp-links-page-free.php. The id parameter accepted from HTTP requests is passed to a database query without adequate escaping and without use of parameterized statements through $wpdb->prepare(). This allows an authenticated attacker to inject SQL fragments that alter the semantics of the executed query.

Because the confidentiality impact is high while integrity and availability remain unaffected, the flaw is primarily useful for data exfiltration rather than modification. Attackers commonly leverage UNION SELECT payloads to enumerate the wp_users, wp_usermeta, and wp_options tables, targeting password hashes, session tokens, and API keys.

Root Cause

The root cause is insufficient input sanitization combined with the absence of proper SQL query preparation. The plugin relies on manual string handling of the id parameter rather than binding it as a typed placeholder through the WordPress $wpdb abstraction layer. When user input reaches the query builder unescaped, the SQL parser treats it as executable syntax.

Attack Vector

Exploitation requires authentication at the Subscriber role or higher, which is trivial to obtain on any WordPress site permitting open registration. The attacker submits a crafted id parameter over HTTP or HTTPS to an endpoint provided by the plugin. Since the attack occurs over the network with low complexity and no user interaction, it is well suited to automated scanning against exposed WordPress installations.

For technical details of the vulnerable code path, refer to the WordPress Plugin Source File and the Wordfence Vulnerability Intelligence entry.

Detection Methods for CVE-2025-10175

Indicators of Compromise

HTTP requests containing SQL syntax tokens such as UNION, SELECT, SLEEP(, or information_schema within the id parameter.
Unexpected database errors written to PHP or MySQL logs referencing the WP Links Page plugin.
Subscriber-level accounts issuing repeated requests to plugin endpoints in short intervals.
Outbound traffic containing WordPress password hashes or session tokens following plugin interaction.

Detection Strategies

Deploy a web application firewall ruleset that inspects the id parameter for SQL metacharacters and known injection payload signatures.
Enable MySQL general query logging in staging environments to identify anomalous UNION-based queries originating from the plugin.
Correlate authentication events with plugin request logs to flag freshly registered Subscriber accounts probing plugin URLs.

Monitoring Recommendations

Monitor the wp_users and wp_usermeta tables for unusual read patterns from the web application user.
Alert on WordPress error log entries referencing wpdb::query failures tied to plugin files.
Track plugin version deployments across WordPress fleets to identify hosts still running 4.9.6 or earlier.

How to Mitigate CVE-2025-10175

Immediate Actions Required

Update the WP Links Page plugin to a version newer than 4.9.6 as soon as a patched release is available from the WordPress Plugin Directory.
Disable open user registration or restrict the default role to prevent unauthenticated attackers from gaining Subscriber privileges.
Audit existing Subscriber and higher-level accounts for signs of unauthorized activity.
Rotate WordPress administrative passwords, API keys, and secrets stored in wp_options if compromise is suspected.

Patch Information

Refer to the WordPress Plugin Change Set for the fix commit and the WordPress Plugin Overview for current release information. Site administrators should apply plugin updates through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate the WP Links Page plugin until an updated version is installed and verified.
Deploy a web application firewall rule to block requests containing SQL syntax in the id parameter targeting plugin endpoints.
Restrict access to plugin URLs by IP address or authenticated administrator role where operationally feasible.

bash

# Configuration example: update or remove the plugin using WP-CLI
wp plugin update wp-links-page
wp plugin deactivate wp-links-page
wp plugin delete wp-links-page