CVE-2025-26886: PublishPress Authors SQLi Vulnerability

CVE-2025-26886 Overview

CVE-2025-26886 is a SQL injection vulnerability in the PublishPress Authors WordPress plugin. The flaw affects all versions up to and including 4.7.3. Attackers with high privileges can inject malicious SQL statements through unsanitized input that reaches database queries. Successful exploitation exposes confidential data stored in the WordPress database and can degrade site availability. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated attacker can extract sensitive database contents from any WordPress site running PublishPress Authors <= 4.7.3, with a scope change that impacts components beyond the vulnerable plugin.

Affected Products

PublishPress Authors plugin for WordPress, versions up to and including 4.7.3
WordPress sites with the publishpress-authors plugin installed and active
Multi-site WordPress environments sharing the affected plugin

Discovery Timeline

2025-03-15 - CVE-2025-26886 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26886

Vulnerability Analysis

The vulnerability stems from improper neutralization of special characters in SQL queries built by the PublishPress Authors plugin. User-supplied input flows into database query construction without parameterization or sanitization. An authenticated user with elevated privileges can supply crafted parameters that alter query logic. The result is unauthorized data retrieval from the WordPress database.

The vulnerability carries a scope change, meaning successful exploitation affects resources beyond the vulnerable component itself. Confidentiality impact is high, while integrity is unaffected and availability impact is low. The EPSS score is 0.308% at the 22.2 percentile, indicating limited observed exploitation activity to date.

Root Cause

The plugin constructs SQL queries by concatenating untrusted input directly into query strings. WordPress provides the $wpdb->prepare() API for parameterized queries, but the affected code paths bypass this safeguard. Special characters such as single quotes, comments, and UNION keywords pass into the database unfiltered.

Attack Vector

The attack vector is network-based and requires high privileges, typically an administrator or editor role on the WordPress site. No user interaction is required. An attacker authenticates to WordPress, then sends crafted requests to plugin endpoints that pass tainted parameters into vulnerable SQL queries. Refer to the Patchstack Vulnerability Report for technical specifics.

Detection Methods for CVE-2025-26886

Indicators of Compromise

HTTP requests to PublishPress Authors plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Database error messages logged from wp-content/plugins/publishpress-authors/ code paths
Unexpected queries against wp_users, wp_usermeta, or wp_options originating from authors-related endpoints
Spikes in authenticated requests from a single session targeting plugin parameters

Detection Strategies

Inspect WordPress access logs for query strings or POST bodies containing SQL syntax aimed at plugin endpoints
Enable MySQL general query logging temporarily to identify anomalous SELECT statements with concatenated payloads
Deploy a web application firewall ruleset that flags SQL injection signatures against /wp-admin/ and plugin AJAX handlers
Correlate authenticated user activity with database query patterns to surface privilege abuse

Monitoring Recommendations

Alert on outbound data transfers from the database host that exceed historical baselines
Track new or modified administrator accounts and unexpected role changes in wp_users
Monitor plugin version inventory across all WordPress instances to identify hosts still on 4.7.3 or earlier
Forward WordPress and MySQL logs to a centralized log platform for retention and search

How to Mitigate CVE-2025-26886

Immediate Actions Required

Update the PublishPress Authors plugin to a version later than 4.7.3 on every WordPress instance
Audit administrator and editor accounts and revoke privileges that are no longer required
Rotate database credentials and WordPress salts if exploitation is suspected
Review recent database backups for unauthorized modifications or data extraction

Patch Information

PublishPress addressed the SQL injection issue in releases after 4.7.3. Site operators should consult the Patchstack Vulnerability Report and the plugin changelog on WordPress.org to confirm the fixed version before upgrading.

Workarounds

Deactivate the PublishPress Authors plugin until the patched version can be installed
Restrict access to the WordPress admin interface using IP allowlists or VPN-only access
Apply a virtual patch through a web application firewall to block SQL injection patterns targeting plugin endpoints
Limit the database user privileges granted to WordPress to the minimum required for normal operation

bash

# Example: restrict MySQL privileges for the WordPress database user
REVOKE FILE, PROCESS, SUPER ON *.* FROM 'wp_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;