CVE-2025-47478: ProfileGrid WordPress Plugin SQLi Flaw

CVE-2025-47478 Overview

CVE-2025-47478 is a SQL Injection vulnerability in the Metagauss ProfileGrid plugin for WordPress, tracked under [CWE-89]. The flaw stems from improper neutralization of special elements used in an SQL command. It affects all versions of profilegrid-user-profiles-groups-and-communities from initial release through 5.9.5.0. An authenticated attacker with low privileges can inject crafted SQL statements that the plugin passes to the database backend. Successful exploitation exposes confidential data and may impact application availability. Patchstack catalogued the issue and published a public advisory describing the affected versions.

Critical Impact

An authenticated attacker can extract sensitive WordPress database contents, including user credentials and session data, by injecting SQL into vulnerable ProfileGrid parameters.

Affected Products

• Metagauss ProfileGrid (profilegrid-user-profiles-groups-and-communities) WordPress plugin
• All versions from initial release through 5.9.5.0
• WordPress sites running ProfileGrid for user profiles, groups, and communities

Discovery Timeline

• 2025-05-23 - CVE-2025-47478 published to the National Vulnerability Database
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47478

Vulnerability Analysis

The vulnerability resides in the ProfileGrid plugin's handling of user-supplied input passed to SQL queries. The plugin fails to sanitize or parameterize values before concatenating them into database statements. An attacker authenticated as a low-privileged user, such as a subscriber, can submit crafted input through plugin endpoints. The resulting query executes attacker-controlled SQL against the WordPress database. The scope is marked as changed, meaning the attacker can reach data beyond the plugin's intended boundary. Confidentiality impact is high because the WordPress wp_users and wp_usermeta tables contain password hashes and session tokens.

Root Cause

The root cause is the absence of prepared statements or proper escaping when building SQL queries from request parameters. WordPress provides the $wpdb->prepare() API for parameterized queries, but ProfileGrid concatenates untrusted values directly. This pattern matches [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

The attack vector is network-based and requires authentication at a low privilege level with no user interaction. An attacker sends a crafted HTTP request to a vulnerable ProfileGrid endpoint, embedding SQL syntax in a parameter that flows into a database query. The injected payload can use UNION-based extraction, boolean-based blind techniques, or time-based blind techniques to read arbitrary database tables. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-47478

Indicators of Compromise

• HTTP requests to ProfileGrid endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
• Unexpected database errors in PHP or web server logs referencing ProfileGrid handlers
• Authenticated low-privilege accounts issuing repeated POST or GET requests to admin-ajax.php actions registered by ProfileGrid
• Outbound queries returning unusually large result sets from the WordPress database

Detection Strategies

• Deploy a web application firewall rule set that inspects requests to /wp-admin/admin-ajax.php and ProfileGrid URLs for SQL injection signatures
• Enable MySQL general query logging temporarily to identify malformed or attacker-crafted statements
• Correlate authentication events with subsequent ProfileGrid request anomalies to surface low-privilege accounts attempting injection

Monitoring Recommendations

• Monitor WordPress audit logs for new administrator accounts or privilege changes following ProfileGrid traffic spikes
• Alert on database errors containing SQL syntax strings tied to ProfileGrid PHP files
• Track HTTP 500 responses from ProfileGrid endpoints, which often indicate injection probing

How to Mitigate CVE-2025-47478

Immediate Actions Required

• Update the ProfileGrid plugin to a version later than 5.9.5.0 once the vendor publishes a fixed release
• Audit WordPress user accounts and rotate credentials for any accounts that could have been exposed
• Review database logs for evidence of unauthorized SELECT statements against wp_users or wp_usermeta

Patch Information

At the time of publication, the Patchstack advisory lists affected versions through 5.9.5.0. Administrators should consult the Patchstack SQL Injection Vulnerability advisory and the Metagauss plugin changelog for the patched release. Apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

• Deactivate the ProfileGrid plugin until a patched version is installed
• Restrict registration so untrusted users cannot obtain the low-privilege accounts required to exploit the flaw
• Deploy WAF rules from providers such as Patchstack or Wordfence that block known ProfileGrid SQL injection payloads

# Update ProfileGrid via WP-CLI once a fixed version is released
wp plugin update profilegrid-user-profiles-groups-and-communities

# Temporary deactivation if no patch is yet available
wp plugin deactivate profilegrid-user-profiles-groups-and-communities