CVE-2025-26974: WP Multistore Locator SQLi Vulnerability

CVE-2025-26974 Overview

CVE-2025-26974 is a Blind SQL Injection vulnerability in the WPExperts.io WP Multistore Locator plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all plugin versions up to and including 2.5.1.

An unauthenticated attacker can send crafted requests over the network to inject SQL into backend queries. Successful exploitation allows extraction of sensitive database contents, including user credentials and administrative data. The issue carries a CVSS 3.1 score of 9.3 and was published to the National Vulnerability Database on February 25, 2025.

Critical Impact
Unauthenticated remote attackers can execute blind SQL injection against WordPress sites running WP Multistore Locator <= 2.5.1, exposing database contents without user interaction.

Affected Products

WPExperts.io WP Multistore Locator plugin for WordPress
All versions from initial release through 2.5.1
WordPress sites with the wp-multi-store-locator plugin installed and active

Discovery Timeline

2025-02-25 - CVE-2025-26974 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26974

Vulnerability Analysis

The vulnerability resides in the WP Multistore Locator plugin, which provides store-locator functionality for WordPress sites. User-supplied input reaches SQL queries without proper sanitization or parameterized binding. Attackers exploit this by injecting SQL syntax into request parameters processed by the plugin.

Because the injection is blind, the application does not return query results directly in HTTP responses. Attackers instead infer data through boolean conditions, time delays, or error-based side channels. Automated tooling such as sqlmap can iteratively extract database contents using these techniques.

The scope is marked as changed in the CVSS vector, meaning the impact extends beyond the vulnerable component. A compromised WordPress database typically exposes the wp_users table, password hashes, session tokens, and site secrets.

Root Cause

The root cause is improper neutralization of special elements in SQL statements [CWE-89]. The plugin concatenates untrusted input into SQL queries instead of using $wpdb->prepare() with parameter placeholders. Standard WordPress database abstraction methods would have prevented this class of flaw.

Attack Vector

The attack vector is network-based with low complexity and no authentication or user interaction required. An attacker sends HTTP requests to a vulnerable endpoint exposed by the plugin. The request carries SQL injection payloads in parameters consumed by the unsafe query path. Refer to the Patchstack Vulnerability Report for technical specifics on the affected endpoint.

Detection Methods for CVE-2025-26974

Indicators of Compromise

HTTP requests to WP Multistore Locator endpoints containing SQL syntax such as UNION SELECT, SLEEP(, BENCHMARK(, or AND 1=1
Anomalous response times on plugin endpoints indicating time-based blind SQL injection probing
WordPress database error entries in debug.log referencing plugin tables or malformed queries
High volumes of requests from a single source enumerating parameter values

Detection Strategies

Inspect web server access logs for plugin URLs containing encoded SQL operators or comment sequences (--, %23, /*)
Deploy a web application firewall ruleset that matches OWASP CRS SQL injection signatures against requests targeting /wp-content/plugins/wp-multi-store-locator/
Correlate WordPress audit logs with HTTP request telemetry to identify authentication anomalies following suspected exploitation

Monitoring Recommendations

Enable WordPress WP_DEBUG_LOG to capture database errors triggered by malformed injection attempts
Forward web server and WAF logs to a centralized SIEM with detection rules for SQL injection patterns
Monitor for unexpected outbound connections from the WordPress host that may indicate post-exploitation data exfiltration

How to Mitigate CVE-2025-26974

Immediate Actions Required

Update WP Multistore Locator to a version later than 2.5.1 once released by the vendor
Disable or remove the wp-multi-store-locator plugin until a patched version is installed
Rotate WordPress administrator passwords, secret keys in wp-config.php, and API tokens if exploitation is suspected
Audit the WordPress database for unauthorized administrator accounts or modified user roles

Patch Information

The vulnerability affects WP Multistore Locator versions up to and including 2.5.1. Consult the Patchstack Vulnerability Report for the latest fixed version information and vendor advisories.

Workarounds

Deploy a web application firewall rule blocking SQL injection patterns against plugin endpoints
Restrict access to WP Multistore Locator endpoints by IP allowlist where feasible
Apply Patchstack or equivalent virtual patching to shield the vulnerable plugin until a vendor fix is applied

bash

# Example ModSecurity rule blocking SQL injection patterns on the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-multi-store-locator/" \
    "id:1002601,phase:2,deny,status:403,log,\
    msg:'CVE-2025-26974 SQLi attempt blocked',\
    chain"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--\s|;--|/\*)" \
        "t:none,t:urlDecodeUni"