CVE-2025-1323: WP-Recall Plugin SQLi Vulnerability

CVE-2025-1323 Overview

CVE-2025-1323 is a critical SQL Injection vulnerability affecting the WP-Recall – Registration, Profile, Commerce & More plugin for WordPress. The vulnerability exists in all versions up to and including 16.26.10 and stems from insufficient escaping on the user-supplied databeat parameter combined with a lack of sufficient preparation on the existing SQL query. This flaw enables unauthenticated attackers to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from WordPress databases, including user credentials, personal information, and potentially gain full control over the affected website.

Affected Products

• WP-Recall – Registration, Profile, Commerce & More plugin for WordPress versions up to and including 16.26.10
• plechevandrey wp-recall (cpe:2.3:a:plechevandrey:wp-recall:*:*:*:*:*:wordpress:*:*)

Discovery Timeline

• 2025-03-08 - CVE-2025-1323 published to NVD
• 2025-03-12 - Last updated in NVD database

Technical Details for CVE-2025-1323

Vulnerability Analysis

This SQL Injection vulnerability occurs within the WP-Recall plugin's chat functionality, specifically in the rcl-chat/core.php file. The vulnerability arises from improper handling of the databeat parameter, which is passed directly into SQL queries without adequate sanitization or parameterized query preparation.

The lack of proper input validation allows attackers to craft malicious SQL statements that get concatenated with legitimate database queries. Since no authentication is required to trigger the vulnerable code path, any remote attacker with network access to the WordPress site can exploit this vulnerability.

Successful exploitation could result in unauthorized disclosure of sensitive database contents, including user credentials, email addresses, payment information, and other confidential data stored within the WordPress database.

Root Cause

The root cause of CVE-2025-1323 is insufficient escaping on the user-supplied databeat parameter and the absence of proper prepared statements in the SQL query construction. The vulnerable code fails to sanitize user input before incorporating it into database queries, violating secure coding practices for database interactions.

WordPress provides the $wpdb->prepare() method specifically to prevent SQL injection attacks, but the vulnerable code path does not utilize this protection mechanism. This oversight allows malicious input to modify the intended SQL query structure.

Attack Vector

The vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can send specially crafted HTTP requests containing malicious SQL payloads in the databeat parameter. The attack can be executed remotely against any WordPress installation running a vulnerable version of the WP-Recall plugin.

The attack flow typically involves:

1. Identifying a WordPress site using the vulnerable WP-Recall plugin
2. Crafting malicious SQL injection payloads targeting the databeat parameter
3. Sending HTTP requests to the vulnerable endpoint
4. Extracting database contents through error-based, blind, or union-based SQL injection techniques

Detection Methods for CVE-2025-1323

Indicators of Compromise

• Unusual SQL error messages appearing in web server logs or error pages
• Suspicious HTTP requests containing SQL syntax characters (single quotes, UNION statements, OR conditions) in the databeat parameter
• Abnormal database query patterns or unexpected database access attempts
• Evidence of data exfiltration or unauthorized access to user records

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection attack patterns targeting the WP-Recall plugin endpoints
• Implement intrusion detection rules to identify malicious SQL syntax in HTTP request parameters
• Review WordPress access logs for unusual request patterns to rcl-chat/core.php or related WP-Recall endpoints
• Deploy database activity monitoring to detect anomalous query execution patterns

Monitoring Recommendations

• Enable detailed logging for WordPress and the underlying database server
• Configure alerts for SQL error conditions that may indicate injection attempts
• Monitor for unusual outbound data transfers that could indicate data exfiltration
• Implement real-time security monitoring for WordPress plugin directories and configuration changes

How to Mitigate CVE-2025-1323

Immediate Actions Required

• Update the WP-Recall plugin to a version newer than 16.26.10 immediately
• If immediate patching is not possible, consider temporarily disabling the WP-Recall plugin until the update can be applied
• Review database access logs for any evidence of prior exploitation
• Implement web application firewall rules to block SQL injection attempts targeting the databeat parameter

Patch Information

The vulnerability has been addressed by the plugin developer. The fix can be reviewed in the WordPress Plugin Changeset 3250094. Additional vulnerability details are available in the Wordfence Vulnerability Report.

WordPress administrators should update the WP-Recall plugin through the WordPress admin dashboard or by manually downloading and installing the latest version from the WordPress plugin repository.

Workarounds

• Deploy a web application firewall (WAF) with SQL injection protection rules as a temporary mitigation measure
• Implement input validation at the web server level to filter requests containing suspicious SQL syntax
• Restrict access to WordPress admin and plugin functionality to trusted IP addresses where feasible
• Consider using database-level access controls to limit the privileges of the WordPress database user

# Configuration example
# Add SQL injection protection rules to .htaccess (temporary mitigation)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (union|select|insert|drop|delete|update|concat|benchmark|char|0x) [NC]
    RewriteRule .* - [F,L]
</IfModule>