CVE-2025-48137 Overview
CVE-2025-48137 is a SQL Injection vulnerability in the Proxymis Interview WordPress plugin. The flaw affects all versions up to and including 1.01. An authenticated attacker with low privileges can inject arbitrary SQL statements through unsanitized input handled by the plugin. Successful exploitation exposes database contents, including WordPress user records and any interview data stored by the plugin. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command and was published to the National Vulnerability Database on May 16, 2025.
Critical Impact
Authenticated attackers can extract sensitive data from the WordPress database, including credential hashes and session tokens, leading to full site compromise.
Affected Products
- Proxymis Interview WordPress plugin, all versions through 1.01
- WordPress installations running the vulnerable plugin
- Sites where low-privileged accounts (subscribers, contributors) can be created
Discovery Timeline
- 2025-05-16 - CVE-2025-48137 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48137
Vulnerability Analysis
The Proxymis Interview plugin fails to properly neutralize special characters in user-supplied input before incorporating that input into SQL queries. An attacker authenticated with at least low-level privileges can send crafted requests containing SQL metacharacters. The database engine then interprets injected fragments as part of the query. This allows the attacker to alter query logic, append UNION statements, or extract arbitrary data using boolean-based or time-based inference techniques.
The vulnerability operates over the network against the WordPress HTTP interface. Attack complexity is low and no user interaction is required beyond the attacker's own authenticated session. Exploitation impacts confidentiality by exposing the contents of the WordPress database, which typically includes the wp_users table containing password hashes.
Root Cause
The root cause is direct concatenation of untrusted input into SQL statements rather than the use of prepared statements or WordPress's $wpdb->prepare() API. When input arrives from a request parameter processed by the plugin, the plugin does not apply esc_sql(), parameter binding, or type casting before the query executes.
Attack Vector
An attacker authenticated as a low-privileged WordPress user submits a crafted request to a plugin endpoint that accepts a vulnerable parameter. The parameter value contains SQL syntax such as UNION SELECT clauses or conditional payloads. The database returns results reflecting the injected logic, allowing extraction of table contents. Refer to the Patchstack advisory for technical specifics on the vulnerable endpoint.
Detection Methods for CVE-2025-48137
Indicators of Compromise
- Unusual HTTP requests to Proxymis Interview plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
- Web server access logs showing encoded payloads (%27, %20OR%20, %23) targeting plugin parameters
- Database error messages logged by WordPress or PHP referencing malformed SQL syntax
- Sudden spikes in query execution time on the WordPress database host
Detection Strategies
- Deploy WordPress-aware web application firewall rules that block SQL injection patterns targeting /wp-admin/admin-ajax.php and plugin-specific routes
- Enable MySQL general query logging temporarily to identify anomalous SELECT statements originating from the WordPress user
- Correlate authenticated session activity with query patterns to detect low-privileged accounts issuing unusual database operations
Monitoring Recommendations
- Monitor authentication events for new low-privileged account registrations followed by requests to Interview plugin endpoints
- Alert on outbound data transfers from the WordPress host that exceed baseline volume
- Track file integrity for WordPress core files and the wp-content/plugins/interview/ directory
How to Mitigate CVE-2025-48137
Immediate Actions Required
- Deactivate and remove the Proxymis Interview plugin until a patched version is published
- Audit WordPress user accounts and remove untrusted low-privileged users
- Rotate all WordPress user passwords and invalidate active sessions if exploitation is suspected
- Review database logs for evidence of unauthorized SELECT operations against sensitive tables
Patch Information
At the time of publication, no fixed version is listed. Versions through 1.01 remain vulnerable. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release.
Workarounds
- Restrict access to WordPress registration and disable open sign-ups to prevent low-privileged account creation
- Apply a virtual patch through a web application firewall that blocks SQL metacharacters in requests to the Interview plugin
- Enforce least privilege on the WordPress database user by removing unnecessary permissions such as FILE and cross-database access
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate interview
wp plugin delete interview
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
