CVE-2025-10187: GSpeech TTS WordPress Plugin SQL Injection

CVE-2025-10187 Overview

CVE-2025-10187 is a SQL Injection vulnerability [CWE-89] in the GSpeech TTS – WordPress Text To Speech Plugin for WordPress. The flaw affects all versions up to and including 3.17.13. Attackers can inject arbitrary SQL via the field parameter due to insufficient escaping and lack of proper query preparation in the plugin's backend code.

Exploitation requires authenticated access at the Administrator level or above. Successful attacks allow adversaries to append additional SQL statements to existing queries, enabling extraction of sensitive database contents such as user credentials and configuration secrets.

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database, leading to disclosure of stored credentials, session tokens, and other confidential records.

Affected Products

GSpeech TTS – WordPress Text To Speech Plugin versions ≤ 3.17.13
WordPress installations with the GSpeech plugin activated
Any site sharing the database with a vulnerable GSpeech deployment

Discovery Timeline

2025-10-18 - CVE-2025-10187 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10187

Vulnerability Analysis

The vulnerability resides in the plugin's backend handler at includes/gspeech_backend.php near line 109. The field parameter received from an authenticated request is concatenated directly into a SQL statement without sanitization or use of prepared statements. This classic injection pattern lets an attacker break out of the intended query context and append additional SQL clauses.

Because the vulnerable endpoint is reachable only after authentication as Administrator, the attack surface is limited to trusted accounts, compromised administrator credentials, or scenarios where privilege escalation from a lower role has already occurred. The confidentiality impact is significant: the underlying wp_users, wp_usermeta, and wp_options tables typically contain password hashes, session tokens, and API keys.

The issue is tracked as CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Details are documented in the Wordfence Vulnerability Analysis.

Root Cause

The root cause is the absence of $wpdb->prepare() around the SQL statement that consumes the field parameter. WordPress provides a parameterized query API, but the vulnerable code path builds the query through string concatenation. See the WordPress GSpeech Backend Code for the affected location.

Attack Vector

An authenticated administrator sends a crafted HTTP request to the plugin endpoint that processes the field parameter. By supplying SQL metacharacters and a UNION SELECT payload, the attacker retrieves arbitrary rows from any table the WordPress database user can read. The vendor fix is documented in the WordPress GSpeech Changeset.

No verified exploit code is publicly available. Refer to the vendor and Wordfence advisories for further technical detail.

Detection Methods for CVE-2025-10187

Indicators of Compromise

Requests to GSpeech plugin endpoints containing SQL metacharacters such as UNION, SELECT, --, or /* in the field parameter
Unusual outbound data transfers following administrative sessions that interacted with the plugin
Web server or application logs showing HTTP 200 responses to malformed field parameter values
Unexpected reads from wp_users or wp_usermeta in database query logs

Detection Strategies

Enable MySQL general query logging and alert on UNION SELECT patterns originating from PHP requests hitting the GSpeech handler
Deploy a web application firewall rule matching SQL injection payloads against requests targeting GSpeech plugin URLs
Audit the installed GSpeech version across WordPress fleets and flag any instance at 3.17.13 or earlier

Monitoring Recommendations

Monitor WordPress administrator account creation, role changes, and login anomalies
Track EPSS movement for CVE-2025-10187 to prioritize remediation as exploit likelihood evolves
Correlate administrator authentication events with subsequent database read spikes

How to Mitigate CVE-2025-10187

Immediate Actions Required

Upgrade the GSpeech TTS plugin to a version later than 3.17.13 once released by the vendor
Rotate all WordPress administrator passwords and API keys stored in wp_options
Review WordPress user accounts and remove unused administrator-level access
Invalidate active sessions and force re-authentication for privileged users

Patch Information

The vendor addressed the injection in the plugin's Subversion repository. Review the WordPress GSpeech Changeset for the corrected query handling. Site owners should update through the WordPress plugin manager or reinstall from the official repository.

Workarounds

Deactivate and remove the GSpeech TTS plugin until a patched version is deployed
Restrict administrator access through IP allowlisting on /wp-admin/
Enforce multi-factor authentication for all administrator accounts to reduce credential compromise risk
Apply WAF virtual patching rules that block SQL metacharacters in the field parameter of GSpeech endpoints

bash

# Example WAF rule (ModSecurity) blocking SQLi in the GSpeech 'field' parameter
SecRule REQUEST_URI "@contains gspeech" \
  "chain,phase:2,deny,status:403,id:1010187,msg:'CVE-2025-10187 GSpeech SQLi attempt'"
  SecRule ARGS:field "@rx (?i)(union(\s|/\*.*\*/)+select|--|;|/\*|xp_)" "t:none,t:urlDecodeUni"