CVE-2025-23774: WPDB to Sql Information Disclosure Flaw

CVE-2025-23774 Overview

CVE-2025-23774 is a sensitive information disclosure vulnerability in the Niket Joshi WPDB to Sql WordPress plugin (wpdb-to-sql). The flaw affects all versions up to and including 1.2. The plugin embeds sensitive data into outputs accessible to unauthenticated network attackers, allowing remote retrieval without authentication or user interaction. The issue is classified under CWE-201: Insertion of Sensitive Information Into Sent Data. Exploitation can expose database content or configuration data that should remain private to administrators.

Critical Impact

Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running WPDB to Sql <= 1.2, leading to confidentiality loss of database-related information.

Affected Products

• Niket Joshi WPDB to Sql WordPress plugin
• All versions from n/a through <= 1.2
• WordPress installations with the wpdb-to-sql plugin enabled

Discovery Timeline

• 2025-01-22 - CVE-2025-23774 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23774

Vulnerability Analysis

The WPDB to Sql plugin generates SQL export output containing sensitive information that gets embedded into responses sent to clients. Because the plugin does not properly restrict who can request these outputs, an unauthenticated attacker reaching the plugin endpoint over the network can retrieve the embedded data. The vulnerability falls under [CWE-201], which covers cases where applications place private data into transmitted content without verifying that the recipient is authorized to receive it.

The weakness affects only the confidentiality of the WordPress site. Integrity and availability remain intact, but exposed database content can include configuration values, schema details, or stored records that aid follow-on attacks. The EPSS score of 0.301% places exploitation probability in the lower half of disclosed vulnerabilities, but unauthenticated network reachability raises real-world risk for internet-exposed WordPress sites.

Root Cause

The root cause is missing authorization checks on the plugin component responsible for producing SQL dumps or database-derived output. The plugin embeds sensitive data into transmitted responses without enforcing capability checks (such as current_user_can('manage_options')) or nonce validation. Any request to the vulnerable endpoint returns the data regardless of caller identity.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the exposed plugin endpoint on a WordPress site running wpdb-to-sql version <= 1.2. The server responds with the embedded sensitive data, which the attacker harvests directly. No authenticated session or social engineering is required.

No verified proof-of-concept code is published. Refer to the Patchstack advisory for WPDB to Sql for technical details.

Detection Methods for CVE-2025-23774

Indicators of Compromise

• Unauthenticated HTTP requests targeting wpdb-to-sql plugin paths under /wp-content/plugins/wpdb-to-sql/ or related admin-ajax actions.
• Unusual outbound responses containing SQL statements, CREATE TABLE, or INSERT INTO fragments from WordPress endpoints.
• Web server access logs showing repeated GET or POST requests to plugin handlers from a single external IP.

Detection Strategies

• Inventory WordPress installations and identify any with the wpdb-to-sql plugin active at version <= 1.2.
• Inspect web access logs for requests to plugin endpoints originating from unauthenticated sessions.
• Deploy WAF signatures that flag responses containing SQL dump patterns leaving WordPress hosts.

Monitoring Recommendations

• Alert on HTTP responses larger than expected from /wp-content/plugins/wpdb-to-sql/ endpoints.
• Monitor for sequential enumeration of plugin URLs across WordPress fleets.
• Track requests with no authentication cookies that return content-types consistent with SQL exports.

How to Mitigate CVE-2025-23774

Immediate Actions Required

• Identify all WordPress sites running the WPDB to Sql plugin and confirm installed version.
• Deactivate and uninstall wpdb-to-sql<= 1.2 until a patched release is available from the maintainer.
• Restrict access to /wp-admin/ and plugin endpoints using IP allowlists or HTTP authentication where feasible.

Patch Information

At the time of NVD publication, no fixed version is listed beyond 1.2. Site operators should monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release that addresses the missing authorization check.

Workarounds

• Remove the wpdb-to-sql plugin entirely if SQL export functionality is not required.
• Place WordPress admin and plugin paths behind a reverse proxy that enforces authentication before reaching PHP handlers.
• Configure a WAF rule to block unauthenticated requests to the plugin's known endpoints and to inspect outbound responses for SQL dump signatures.

# Example: block unauthenticated access to the plugin path via nginx
location ~* /wp-content/plugins/wpdb-to-sql/ {
    deny all;
    return 403;
}