CVE-2025-23774: WPDB to Sql Information Disclosure Bug

CVE-2025-23774 Overview

CVE-2025-23774 is a sensitive information disclosure vulnerability in the Niket Joshi WPDB to Sql WordPress plugin (wpdb-to-sql). The flaw affects all versions up to and including 1.2. It is categorized under [CWE-201]: Insertion of Sensitive Information Into Sent Data. Unauthenticated remote attackers can retrieve embedded sensitive data from affected WordPress installations over the network without user interaction. The vulnerability carries a CVSS 3.1 base score of 7.5, reflecting high confidentiality impact with no required privileges. Public reporting on the issue was published through Patchstack on January 22, 2025.

Critical Impact
Unauthenticated attackers can retrieve sensitive database export data exposed by the WPDB to Sql plugin, leading to disclosure of WordPress database contents.

Affected Products

Niket Joshi WPDB to Sql plugin (wpdb-to-sql)
All versions from n/a through 1.2
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-22 - CVE-2025-23774 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23774

Vulnerability Analysis

The WPDB to Sql plugin generates SQL exports of the WordPress database content. The vulnerability stems from improper protection of generated output, allowing sensitive information to be embedded in data sent to unauthorized recipients. An attacker reaches the affected endpoint over the network without authentication or user interaction.

The issue maps to [CWE-201], where the product transmits a resource that contains sensitive data alongside legitimate output. In this case, WordPress database content such as user records, configuration values, and other table data can be exposed to an unauthenticated requester. The EPSS probability for this CVE is 0.301%.

Root Cause

The plugin fails to enforce access control or sanitize sensitive fields before sending SQL export content in its response. Files or output streams generated by the plugin are reachable without authentication checks, exposing embedded database contents to any remote requester.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin and retrieves the SQL export data. No credentials, prior access, or victim interaction are required. Exploitation results in disclosure of database content but does not directly modify data or affect availability.

No public proof-of-concept code has been published. Technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-23774

Indicators of Compromise

Unauthenticated HTTP GET requests targeting plugin paths under /wp-content/plugins/wpdb-to-sql/
Responses containing SQL statements such as CREATE TABLE, INSERT INTO wp_users, or INSERT INTO wp_options returned to unauthenticated clients
Large outbound responses from WordPress endpoints to external IP addresses requesting plugin resources
Web server access logs showing requests to plugin export endpoints from unknown sources

Detection Strategies

Audit installed WordPress plugins and flag any host running wpdb-to-sql version 1.2 or earlier
Inspect web access logs for requests to plugin export URLs originating from non-administrative IP ranges
Monitor HTTP response bodies for SQL dump signatures returned without prior authentication cookies
Apply WAF rules to alert on responses containing database schema keywords from plugin paths

Monitoring Recommendations

Continuously inventory WordPress plugins across all hosted sites and correlate against published vulnerability feeds
Enable verbose access logging for /wp-content/plugins/ paths and forward logs to a centralized analytics platform
Set alerts on anomalous data transfer volumes from WordPress instances to external destinations
Track repeated requests from a single source against plugin endpoints to identify scanning activity

How to Mitigate CVE-2025-23774

Immediate Actions Required

Identify all WordPress sites running the WPDB to Sql plugin and confirm the installed version
Deactivate and remove the plugin if it is not in active use
Restrict access to plugin paths at the web server or WAF layer until a patched version is verified
Rotate any credentials, API keys, or secrets that may have been stored in the WordPress database and could have been exposed

Patch Information

As of the last NVD update on 2026-04-23, no fixed version is referenced for wpdb-to-sql. The advisory covers all versions through 1.2. Administrators should consult the Patchstack Vulnerability Report for current remediation status and consider removing the plugin if no patched release is available.

Workarounds

Block public access to the plugin directory with web server access rules
Require authentication at the reverse proxy layer for any administrative or export endpoints
Deploy a virtual patch through a WordPress-aware WAF to block unauthenticated requests to plugin export functions
Replace WPDB to Sql with a maintained alternative that enforces capability checks before generating database exports

bash

# Apache configuration example to block direct access to the plugin directory
<Directory "/var/www/html/wp-content/plugins/wpdb-to-sql">
    Require all denied
</Directory>

# Nginx equivalent
location ~* /wp-content/plugins/wpdb-to-sql/ {
    deny all;
    return 403;
}