CVE-2025-11177: WordPress External Login SQLi Vulnerability

CVE-2025-11177 Overview

CVE-2025-11177 is a SQL Injection vulnerability in the External Login plugin for WordPress, affecting all versions up to and including 1.11.2. The flaw resides in the handling of the log parameter, where insufficient escaping and missing query preparation allow unauthenticated attackers to append arbitrary SQL statements to existing queries. Exploitation is possible when the plugin is configured with a PostgreSQL or MSSQL backend as the external authentication database. Successful attacks expose sensitive database contents, including credentials and user records.

Critical Impact

Unauthenticated remote attackers can extract sensitive data from PostgreSQL or MSSQL authentication databases by injecting SQL through the login form's log parameter.

Affected Products

• WordPress External Login plugin versions ≤ 1.11.2
• Deployments configured with PostgreSQL as the external authentication database
• Deployments configured with Microsoft SQL Server (MSSQL) as the external authentication database

Discovery Timeline

• 2025-10-15 - CVE-2025-11177 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11177

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89] and affects the authentication path of the External Login plugin. When a user submits credentials, the plugin forwards the supplied log (username) parameter into a SQL query executed against the configured external database. The plugin fails to escape this input or use parameterized statements, allowing attacker-controlled syntax to alter the query structure.

The defect is reachable pre-authentication through the standard WordPress login endpoint. Attackers do not need valid credentials, user interaction, or elevated privileges to trigger the flaw. The impact is scoped to confidentiality, since the injection point sits within a SELECT query used to look up user records, enabling data extraction through UNION-based or stacked query techniques depending on the database engine.

Root Cause

The root cause is improper neutralization of special elements in the SQL query construction logic at login/db.php line 153. The log parameter is concatenated directly into the SQL string sent to the external database driver. Because PostgreSQL and MSSQL drivers permit query semantics that the plugin's escaping routine does not account for, payloads bypass the limited sanitization. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical specifics.

Attack Vector

An unauthenticated attacker submits a crafted log value to the WordPress login endpoint. The malicious payload terminates the existing SQL clause and appends additional statements or UNION SELECT queries to exfiltrate data such as password hashes, session tokens, or other records stored in the external authentication database. Sites using the default MySQL backend are not affected; only PostgreSQL or MSSQL configurations are exploitable.

Detection Methods for CVE-2025-11177

Indicators of Compromise

• HTTP POST requests to wp-login.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; within the log parameter
• Anomalous queries logged by the external PostgreSQL or MSSQL server originating from the WordPress host
• Authentication failures correlated with malformed or unusually long log values

Detection Strategies

• Inspect web server access logs for wp-login.php requests where the log parameter contains SQL syntax
• Enable database query logging on PostgreSQL and MSSQL backends and alert on queries containing unexpected UNION or comment sequences
• Deploy a Web Application Firewall (WAF) ruleset targeting SQL Injection patterns on WordPress login endpoints

Monitoring Recommendations

• Forward WordPress, web server, and external database logs into a centralized SIEM for correlation
• Monitor for spikes in failed login attempts that may indicate automated injection probing
• Track outbound data volumes from the database tier to detect bulk extraction attempts

How to Mitigate CVE-2025-11177

Immediate Actions Required

• Update the External Login plugin to a version newer than 1.11.2 once the vendor publishes a fix
• Audit WordPress installations to identify sites using PostgreSQL or MSSQL as the external authentication backend
• Review web server and database logs for evidence of prior exploitation attempts against the log parameter

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.11.2. Administrators should monitor the plugin's repository on WordPress.org and the Wordfence Vulnerability Report for the patched release.

Workarounds

• Deactivate the External Login plugin until a patched version is available
• Switch the external authentication database to MySQL, which is not affected by this injection path
• Restrict access to wp-login.php using IP allowlisting or HTTP authentication at the web server layer
• Deploy WAF rules that block SQL metacharacters in the log POST parameter

# Example nginx rule to block SQL metacharacters in the log parameter
if ($args ~* "log=.*(\bunion\b|\bselect\b|--|;|')") {
    return 403;
}