CVE-2025-26974: WP Multi Store Locator SQLi Vulnerability

CVE-2025-26974 Overview

CVE-2025-26974 is a critical SQL Injection vulnerability affecting the WP Multi Store Locator plugin for WordPress, developed by WPExperts.io. This vulnerability allows unauthenticated attackers to perform Blind SQL Injection attacks against WordPress sites running vulnerable versions of the plugin. The improper neutralization of special elements in SQL commands enables malicious actors to extract sensitive database information, potentially compromising user credentials, site configurations, and other stored data.

Critical Impact

Unauthenticated attackers can exploit this Blind SQL Injection vulnerability to extract sensitive data from the WordPress database, including user credentials, email addresses, and potentially gain administrative access to affected sites.

Affected Products

• WP Multi Store Locator plugin versions through 2.5.1
• WordPress sites with WP Multi Store Locator installed
• Any site using vulnerable WPExperts.io store locator functionality

Discovery Timeline

• 2025-02-25 - CVE-2025-26974 published to NVD
• 2025-02-25 - Last updated in NVD database

Technical Details for CVE-2025-26974

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the WP Multi Store Locator plugin due to improper sanitization of user-supplied input before incorporating it into SQL queries. The plugin fails to properly neutralize special characters used in SQL syntax, allowing attackers to inject malicious SQL statements that are then executed by the database.

The Blind SQL Injection nature of this vulnerability means that attackers cannot directly see the output of injected queries. Instead, they must infer database contents through observable differences in application behavior, such as timing delays or conditional responses. This technique, while slower than traditional SQL Injection, is equally dangerous as it allows complete database extraction.

WordPress plugins that handle store location data often process user inputs for searching, filtering, and displaying store information. When these inputs are not properly sanitized, they create injection points that attackers can exploit to manipulate backend database queries.

Root Cause

The root cause of CVE-2025-26974 is the failure to implement proper input validation and parameterized queries when handling user-supplied data within the WP Multi Store Locator plugin. The plugin likely constructs SQL queries by directly concatenating user input without using WordPress's built-in prepared statement methods ($wpdb->prepare()), leaving the application vulnerable to SQL Injection attacks.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. Attackers can craft malicious requests containing SQL injection payloads directed at vulnerable plugin endpoints. Due to the blind nature of this vulnerability, attackers typically employ time-based or boolean-based techniques to extract data character by character.

Common attack scenarios include:

• Extracting WordPress administrator credentials from the wp_users table
• Retrieving sensitive configuration data from wp_options
• Enumerating database structure for further exploitation
• Potential privilege escalation through credential theft

The vulnerability mechanism involves sending specially crafted input to the plugin's data handling functions. For detailed technical information about this SQL Injection vulnerability, refer to the Patchstack WordPress Vulnerability Advisory.

Detection Methods for CVE-2025-26974

Indicators of Compromise

• Unusual database query patterns in WordPress logs, particularly those containing SQL keywords like SLEEP(), BENCHMARK(), or WAITFOR
• Abnormal response times on store locator pages indicating time-based SQL injection attempts
• Error log entries showing malformed SQL queries or database errors
• Unexpected data exfiltration or unauthorized access to admin accounts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect common SQL injection patterns including UNION-based, time-based, and boolean-based injection signatures
• Enable detailed logging on WordPress and database servers to capture suspicious query patterns
• Monitor for automated scanning tools targeting known WordPress plugin vulnerabilities
• Deploy SentinelOne Singularity Platform to detect post-exploitation activities and lateral movement

Monitoring Recommendations

• Configure alerts for failed authentication attempts following suspicious web traffic patterns
• Monitor database query logs for injection signatures and anomalous query structures
• Track changes to critical WordPress tables, especially wp_users and wp_options
• Implement real-time monitoring of plugin-related endpoints for high-volume or malformed requests

How to Mitigate CVE-2025-26974

Immediate Actions Required

• Update WP Multi Store Locator to a patched version as soon as one becomes available from WPExperts.io
• If unable to update immediately, consider temporarily deactivating the WP Multi Store Locator plugin
• Implement WAF rules to block SQL injection attempts targeting your WordPress installation
• Review database access logs for signs of prior exploitation and rotate credentials if compromise is suspected

Patch Information

Organizations should monitor WPExperts.io and the official WordPress plugin repository for security updates addressing this vulnerability. Until a patch is released, implementing the recommended workarounds is strongly advised. The Patchstack security advisory provides additional details on the vulnerability status.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests
• Temporarily disable the WP Multi Store Locator plugin if store locator functionality is not critical
• Restrict database user privileges to limit potential damage from SQL injection attacks
• Implement IP-based access controls to limit exposure of vulnerable endpoints

# Configuration example - WordPress WAF rule (ModSecurity)
# Block common SQL injection patterns in store locator requests
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-multi-store-locator/" \
    "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Blocked', \
    chain"
SecRule ARGS "@detectSQLi" "setvar:tx.sql_injection_score=+1"