CVE-2025-11980: WordPress Quick Featured Images SQL Injection

CVE-2025-11980 is an SQL injection vulnerability in the Quick Featured Images WordPress plugin affecting versions up to 13.7.3. Authenticated attackers with Editor-level access can extract sensitive database information. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-11980 Overview

CVE-2025-11980 is a SQL Injection vulnerability [CWE-89] in the Quick Featured Images plugin for WordPress. The flaw affects all versions up to and including 13.7.3. The vulnerable code resides in the delete_orphaned function, which fails to properly escape user-supplied parameters and does not use prepared statements. Authenticated attackers with Editor-level access or higher can append additional SQL queries to existing database operations. Successful exploitation requires convincing an author-level or higher user to add a malicious custom field value, which is then processed unsafely by the plugin.

Critical Impact
Authenticated attackers can extract sensitive information from the WordPress database, including user credentials, session tokens, and configuration secrets stored in the wp_options table.

Affected Products

Quick Featured Images plugin for WordPress — all versions through 13.7.3
WordPress installations using the vulnerable plugin with Editor-level or higher accounts
Multi-author WordPress sites where lower-privileged authors can add custom field values

Discovery Timeline

2025-11-08 - CVE-2025-11980 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11980

Vulnerability Analysis

The vulnerability stems from insecure database query construction inside the delete_orphaned function within class-Quick_Featured_Images_Tools.php. The plugin builds SQL statements using unsanitized custom field values retrieved from posts. An attacker with Editor privileges can trigger the orphan cleanup routine to process values previously injected through legitimate content workflows.

Exploitation requires a two-stage social engineering component. An author-level user must first save a crafted custom field value containing malicious SQL fragments. When an Editor subsequently runs the plugin's cleanup functionality, the injected payload executes against the database. This second-order injection pattern makes the flaw harder to detect through standard input validation review.

Root Cause

The root cause is the failure to use WordPress's $wpdb->prepare() method with parameterized queries. The plugin concatenates user-controlled custom field content directly into SQL statements at lines 785 and 817 of the affected class. Standard escaping via esc_sql() is also absent, allowing attackers to break out of the query context.

Attack Vector

The attack requires network access to the WordPress administrative interface and authenticated Editor-level credentials. The attacker also depends on an author or higher-privileged user placing a malicious custom field value on a post. Once these preconditions are met, invoking the orphan cleanup functionality executes the injected SQL. The injection supports data extraction techniques such as UNION-based queries and boolean-based blind extraction against the WordPress database.

The vulnerable code paths can be reviewed in the WordPress Plugin Source at line 785 and line 817.

Detection Methods for CVE-2025-11980

Indicators of Compromise

Unexpected SQL syntax patterns such as UNION SELECT, SLEEP(, or comment sequences (--, #, /*) stored in post meta fields
Web server access logs showing Editor-authenticated requests to Quick Featured Images admin endpoints followed by anomalous database response times
Unusual outbound queries from the WordPress database process referencing wp_users, wp_usermeta, or wp_options tables in aggregate patterns
Presence of the Quick Featured Images plugin at version 13.7.3 or earlier in wp-content/plugins/quick-featured-images/

Detection Strategies

Audit wp_postmeta entries for custom field values containing SQL keywords or characters like single quotes, parentheses, and union statements
Enable MySQL general query logging temporarily and inspect queries originating from the delete_orphaned code path
Deploy a Web Application Firewall (WAF) with rules targeting SQL injection payloads in POST bodies to /wp-admin/ endpoints

Monitoring Recommendations

Monitor WordPress user role changes and privilege escalations to Editor level from newly created accounts
Alert on sudden spikes in database query duration or result set size associated with plugin administrative actions
Track file integrity of class-Quick_Featured_Images_Tools.php to detect tampering or delayed patching

How to Mitigate CVE-2025-11980

Immediate Actions Required

Update the Quick Featured Images plugin to a version above 13.7.3 as soon as a patched release is available from the vendor
Audit all existing Editor and Administrator accounts and remove any that are unnecessary or dormant
Review wp_postmeta for suspicious custom field values inserted by author-level accounts
Rotate WordPress database credentials and administrator passwords if compromise is suspected

Patch Information

Refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Advisory for the current patch status and remediation guidance.

Workarounds

Deactivate the Quick Featured Images plugin until a patched version is installed
Restrict Editor-level access to trusted administrators only and enforce multi-factor authentication on all privileged accounts
Configure a WAF rule to block SQL injection payloads targeting the plugin's admin AJAX and tool endpoints
Implement least-privilege database credentials for WordPress, denying INFORMATION_SCHEMA access where feasible

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate quick-featured-images
wp plugin status quick-featured-images