CVE-2025-32128: Nearby Locations SQLi Vulnerability

CVE-2025-32128 Overview

CVE-2025-32128 is a SQL Injection vulnerability in the aaronfrey Nearby Locations WordPress plugin. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all versions of the nearby-locations plugin up to and including 1.1.1. Authenticated attackers with high privileges can inject arbitrary SQL statements through vulnerable parameters processed by the plugin. Successful exploitation can expose sensitive database contents and disrupt application availability. The vulnerability was published to the National Vulnerability Database on April 10, 2025.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing confidential data and affecting availability of the WordPress site.

Affected Products

WordPress plugin nearby-locations by aaronfrey
All versions from n/a through <= 1.1.1
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-04-10 - CVE-2025-32128 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32128

Vulnerability Analysis

The Nearby Locations plugin fails to properly sanitize user-supplied input before incorporating it into SQL statements. This allows an authenticated attacker to break out of the intended query context and inject arbitrary SQL syntax. The scope is classified as changed, meaning the impact extends beyond the vulnerable component to the underlying WordPress database. Exploitation exposes confidential records and can partially degrade availability of the affected site.

The EPSS probability for this vulnerability stands at 0.355%, indicating low observed exploitation activity to date. However, WordPress plugin SQL injection flaws are a recurring target for opportunistic attackers scanning at scale.

Root Cause

The root cause is unsanitized input concatenated into SQL queries executed by the plugin. The plugin does not use parameterized queries or the WordPress $wpdb->prepare() API to safely handle user input. As a result, special SQL metacharacters such as single quotes, comments, and UNION clauses pass through directly into the query engine.

Attack Vector

Exploitation occurs over the network against a WordPress site that has the vulnerable plugin installed and activated. The attacker must possess high-privilege authentication such as an administrator or editor role, depending on the plugin endpoint. No user interaction is required. The attacker submits crafted input to a plugin parameter that is passed unsanitized into an SQL query, allowing extraction of database contents or manipulation of query logic.

Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-32128

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, or -- in HTTP request logs targeting nearby-locations endpoints
Anomalous database query patterns originating from the WordPress PHP worker process
Sudden spikes in read volume against the wp_users or wp_options tables
Presence of the nearby-locations plugin at version 1.1.1 or earlier in /wp-content/plugins/

Detection Strategies

Enable WordPress query logging or database audit logging to identify malformed queries referencing plugin functions
Deploy a Web Application Firewall (WAF) with signatures for SQL injection payloads targeting WordPress plugins
Correlate authenticated admin session activity with database anomalies to identify malicious insider or account takeover behavior
Inventory installed plugins across managed WordPress instances and flag nearby-locations <= 1.1.1

Monitoring Recommendations

Alert on HTTP requests to plugin endpoints containing SQL metacharacters or encoded variants
Monitor for unusual outbound data transfer from web servers hosting WordPress
Track new or modified administrator accounts and unexpected privilege changes
Log and review all authenticated plugin parameter submissions for anomalies

How to Mitigate CVE-2025-32128

Immediate Actions Required

Identify all WordPress installations running the nearby-locations plugin at version 1.1.1 or earlier
Deactivate and remove the plugin if a patched version is not yet available
Restrict administrator and editor account access to trusted personnel and enforce strong authentication
Review database and web server logs for signs of prior exploitation attempts

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry beyond the statement that versions up to and including 1.1.1 are affected. Site administrators should consult the Patchstack advisory and the plugin repository for the latest patched release before reinstalling.

Workarounds

Deactivate the nearby-locations plugin until a verified patch is applied
Apply WAF rules that block SQL injection payloads targeting plugin request parameters
Restrict access to WordPress administrative interfaces using IP allowlists or VPN gating
Enforce least privilege by reducing the number of high-privilege WordPress accounts

bash

# Configuration example: identify and deactivate the vulnerable plugin via WP-CLI
wp plugin list --name=nearby-locations --fields=name,status,version
wp plugin deactivate nearby-locations
wp plugin delete nearby-locations