CVE-2025-26915 Overview
CVE-2025-26915 is a SQL injection vulnerability in the PickPlugins Wishlist plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. All versions of the Wishlist plugin up to and including 1.0.41 are affected. An authenticated attacker with low privileges can exploit the vulnerability over the network to inject arbitrary SQL statements into backend database queries.
Critical Impact
An authenticated attacker can read sensitive database contents and impact site availability through crafted SQL payloads sent to the vulnerable plugin endpoints.
Affected Products
- PickPlugins Wishlist plugin for WordPress
- Wishlist versions through 1.0.41
- WordPress sites running the vulnerable plugin
Discovery Timeline
- 2025-02-25 - CVE-2025-26915 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26915
Vulnerability Analysis
The vulnerability resides in the PickPlugins Wishlist plugin, where user-supplied input is concatenated into SQL queries without adequate sanitization or parameterization. Attackers with at least low-privileged authenticated access can manipulate query parameters to alter the structure of executed SQL statements. The scope is marked as changed, indicating the injection can affect resources beyond the vulnerable component itself, including data accessible to the WordPress database user.
Exploitation yields high confidentiality impact and limited availability impact. The integrity impact is rated as none, suggesting the attacker can extract or enumerate data and disrupt query execution but cannot directly alter persisted records through this specific flaw. The EPSS probability is 0.375%, placing it in the 29th percentile of CVEs in terms of near-term exploitation likelihood.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input passed to plugin handlers is interpolated into SQL queries without prepared statements or proper escaping using WordPress functions such as $wpdb->prepare(). Attackers leverage this to break out of the intended query context.
Attack Vector
The attack vector is network-based and requires low-privileged authentication, such as a subscriber-level account on the target WordPress site. No user interaction is required. An attacker submits crafted parameters to plugin endpoints that invoke vulnerable database queries. The plugin then executes attacker-controlled SQL against the WordPress database.
No verified public proof-of-concept code is referenced in the available advisory data. Technical details are described in the Patchstack SQL Injection Vulnerability entry.
Detection Methods for CVE-2025-26915
Indicators of Compromise
- Unusual SQL syntax fragments such as UNION SELECT, SLEEP(, OR 1=1, or comment markers appearing in HTTP request parameters targeting Wishlist plugin endpoints.
- Spikes in slow or failed database queries originating from wp-admin/admin-ajax.php or Wishlist-specific routes.
- Authenticated requests from low-privileged accounts generating database errors logged by WordPress or the underlying MySQL/MariaDB server.
Detection Strategies
- Inspect web server access logs for query strings containing encoded SQL metacharacters directed at Wishlist plugin paths.
- Enable WordPress debug logging and MySQL general query logging to surface malformed or anomalous queries traceable to plugin code paths.
- Deploy a web application firewall with SQL injection signature rules tuned for WordPress plugin parameters.
Monitoring Recommendations
- Monitor authentication events for newly created low-privilege accounts followed by activity against plugin endpoints.
- Alert on database errors and abnormal query duration tied to the WordPress database user.
- Track plugin version inventory across WordPress sites and flag installations running Wishlist 1.0.41 or earlier.
How to Mitigate CVE-2025-26915
Immediate Actions Required
- Update the PickPlugins Wishlist plugin to a version newer than 1.0.41 once a fixed release is published by the vendor.
- If no patched version is available, deactivate and remove the Wishlist plugin from affected WordPress sites.
- Audit WordPress user accounts and remove or disable unused low-privileged accounts that could be leveraged for authenticated exploitation.
Patch Information
At the time of publication, the advisory lists the issue as affecting Wishlist versions through 1.0.41. Administrators should consult the Patchstack SQL Injection Vulnerability advisory and the plugin's official changelog for the fixed release. Apply the vendor-supplied update across all WordPress installations once available.
Workarounds
- Restrict access to the WordPress site using IP allowlists or authentication proxies until the plugin is patched or removed.
- Deploy a virtual patch in a web application firewall to block SQL metacharacters in requests targeting Wishlist plugin parameters.
- Apply least-privilege principles to the WordPress database user to limit the data exposed by a successful injection.
# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate wishlist
wp plugin delete wishlist
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
