CVE-2025-23910 Overview
CVE-2025-23910 is a SQL Injection vulnerability in the keighl Menus Plus+ WordPress plugin (menus-plus). The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all plugin versions up to and including 1.9.6. An authenticated attacker with low privileges can inject arbitrary SQL statements over the network. Successful exploitation leads to disclosure of database contents and partial impact on availability, with a scope change indicating effects beyond the vulnerable component.
Critical Impact
Authenticated attackers can extract sensitive WordPress database contents, including user records and credentials, by injecting SQL through the Menus Plus+ plugin.
Affected Products
- keighl Menus Plus+ (menus-plus) WordPress plugin
- All versions from initial release through 1.9.6
- WordPress sites with the Menus Plus+ plugin installed and active
Discovery Timeline
- 2025-01-22 - CVE-2025-23910 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23910
Vulnerability Analysis
The vulnerability resides in the Menus Plus+ plugin's handling of user-supplied input that is passed into SQL queries without proper sanitization or parameterization. The plugin concatenates untrusted input into database queries executed against the WordPress backend.
An attacker with at least subscriber-level access can submit crafted parameters that break out of the intended query context. The scope-changing nature of the issue means injected SQL can reach data beyond the plugin's own tables, including the broader WordPress schema.
The vulnerability primarily compromises confidentiality, allowing extraction of arbitrary database rows. Availability is also partially affected, as malformed queries can disrupt normal plugin functionality.
Root Cause
The root cause is missing or insufficient input validation and the absence of prepared statements when constructing SQL queries. User-controlled values are interpolated directly into query strings, allowing meta-characters such as quotes and UNION clauses to alter query semantics.
Attack Vector
Exploitation occurs remotely over the network through standard HTTP(S) requests to the vulnerable plugin endpoints. The attacker must hold a low-privileged authenticated session on the target WordPress site. No user interaction from administrators is required. Refer to the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-23910
Indicators of Compromise
- HTTP requests to Menus Plus+ plugin endpoints containing SQL meta-characters such as ', --, UNION SELECT, or SLEEP(
- Unusual wp_users or wp_options table reads originating from low-privileged accounts
- WordPress database error messages logged following requests to menus-plus actions
- Outbound traffic from the web server immediately following suspicious plugin requests, suggesting data exfiltration
Detection Strategies
- Inspect web server access logs for query strings and POST bodies targeting menus-plus parameters with SQL syntax
- Enable WordPress debug logging and alert on database errors referencing plugin-related tables or queries
- Deploy a web application firewall rule set that flags SQL injection patterns on authenticated plugin endpoints
- Correlate authentication events for subscriber or contributor accounts with subsequent plugin requests
Monitoring Recommendations
- Forward WordPress, PHP, and database error logs to a centralized logging platform for retention and analysis
- Monitor for new or unexpected administrator accounts and password hash changes in wp_users
- Track request rates and parameter entropy against Menus Plus+ endpoints to identify automated injection attempts
How to Mitigate CVE-2025-23910
Immediate Actions Required
- Update the Menus Plus+ plugin to a version later than 1.9.6 once a fixed release is published by the maintainer
- Deactivate and remove the plugin if a patched version is not yet available and the functionality is non-essential
- Rotate WordPress administrator passwords and database credentials if exploitation is suspected
- Audit user accounts for unauthorized privilege changes or newly created administrators
Patch Information
At the time of publication, the Patchstack advisory lists all versions through 1.9.6 as affected. Site operators should monitor the official plugin repository for an updated release and apply it as soon as it becomes available.
Workarounds
- Restrict access to WordPress authenticated endpoints using IP allowlisting on the web server or reverse proxy
- Deploy a web application firewall with virtual patching rules targeting SQL injection patterns on Menus Plus+ URLs
- Apply the principle of least privilege to the database account used by WordPress, removing unnecessary FILE or cross-schema permissions
# Example WAF rule snippet (ModSecurity) to block SQLi patterns on plugin paths
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
"chain,phase:2,deny,status:403,id:1002391,msg:'Possible SQLi in Menus Plus+'"
SecRule ARGS "@rx (?i)(union(\s)+select|sleep\(|--|;--|/\*)" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
