CVE-2025-11177: WordPress External Login SQLi Vulnerability

CVE-2025-11177 Overview

CVE-2025-11177 is a SQL Injection vulnerability in the External Login plugin for WordPress, affecting all versions up to and including 1.11.2. The flaw resides in the handling of the log parameter, where insufficient escaping and missing query preparation allow unauthenticated attackers to append arbitrary SQL statements to existing queries. Exploitation is possible when the plugin is configured with a PostgreSQL or MSSQL backend as the external authentication database. Successful attacks expose sensitive database contents, including credentials and user records.

Critical Impact
Unauthenticated remote attackers can extract sensitive data from PostgreSQL or MSSQL authentication databases by injecting SQL through the login form's log parameter.

Affected Products

WordPress External Login plugin versions ≤ 1.11.2
Deployments configured with PostgreSQL as the external authentication database
Deployments configured with Microsoft SQL Server (MSSQL) as the external authentication database

Discovery Timeline

2025-10-15 - CVE-2025-11177 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11177

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89] and affects the authentication path of the External Login plugin. When a user submits credentials, the plugin forwards the supplied log (username) parameter into a SQL query executed against the configured external database. The plugin fails to escape this input or use parameterized statements, allowing attacker-controlled syntax to alter the query structure.

The defect is reachable pre-authentication through the standard WordPress login endpoint. Attackers do not need valid credentials, user interaction, or elevated privileges to trigger the flaw. The impact is scoped to confidentiality, since the injection point sits within a SELECT query used to look up user records, enabling data extraction through UNION-based or stacked query techniques depending on the database engine.

Root Cause

The root cause is improper neutralization of special elements in the SQL query construction logic at login/db.php line 153. The log parameter is concatenated directly into the SQL string sent to the external database driver. Because PostgreSQL and MSSQL drivers permit query semantics that the plugin's escaping routine does not account for, payloads bypass the limited sanitization. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical specifics.

Attack Vector

An unauthenticated attacker submits a crafted log value to the WordPress login endpoint. The malicious payload terminates the existing SQL clause and appends additional statements or UNION SELECT queries to exfiltrate data such as password hashes, session tokens, or other records stored in the external authentication database. Sites using the default MySQL backend are not affected; only PostgreSQL or MSSQL configurations are exploitable.

Detection Methods for CVE-2025-11177

Indicators of Compromise

HTTP POST requests to wp-login.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; within the log parameter
Anomalous queries logged by the external PostgreSQL or MSSQL server originating from the WordPress host
Authentication failures correlated with malformed or unusually long log values

Detection Strategies

Inspect web server access logs for wp-login.php requests where the log parameter contains SQL syntax
Enable database query logging on PostgreSQL and MSSQL backends and alert on queries containing unexpected UNION or comment sequences
Deploy a Web Application Firewall (WAF) ruleset targeting SQL Injection patterns on WordPress login endpoints

Monitoring Recommendations

Forward WordPress, web server, and external database logs into a centralized SIEM for correlation
Monitor for spikes in failed login attempts that may indicate automated injection probing
Track outbound data volumes from the database tier to detect bulk extraction attempts

How to Mitigate CVE-2025-11177

Immediate Actions Required

Update the External Login plugin to a version newer than 1.11.2 once the vendor publishes a fix
Audit WordPress installations to identify sites using PostgreSQL or MSSQL as the external authentication backend
Review web server and database logs for evidence of prior exploitation attempts against the log parameter

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.11.2. Administrators should monitor the plugin's repository on WordPress.org and the Wordfence Vulnerability Report for the patched release.

Workarounds

Deactivate the External Login plugin until a patched version is available
Switch the external authentication database to MySQL, which is not affected by this injection path
Restrict access to wp-login.php using IP allowlisting or HTTP authentication at the web server layer
Deploy WAF rules that block SQL metacharacters in the log POST parameter

bash

# Example nginx rule to block SQL metacharacters in the log parameter
if ($args ~* "log=.*(\bunion\b|\bselect\b|--|;|')") {
    return 403;
}