CVE-2025-60118 Overview
CVE-2025-60118 is a SQL Injection vulnerability in the Potenzaglobalsolutions PGS Core (pgs-core) WordPress plugin. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all versions of PGS Core up to and including 5.9.0. An authenticated attacker with low privileges can send crafted input over the network to manipulate database queries. The scope is changed, meaning exploitation can affect resources beyond the vulnerable component. Successful exploitation leads to confidentiality disclosure and limited availability impact on the underlying database.
Critical Impact
Authenticated attackers can extract sensitive WordPress database contents and disrupt site availability through crafted SQL payloads.
Affected Products
- Potenzaglobalsolutions PGS Core (pgs-core) WordPress plugin
- All versions from initial release through 5.9.0
- WordPress sites running the vulnerable plugin build
Discovery Timeline
- 2025-09-26 - CVE-2025-60118 published to the National Vulnerability Database (NVD)
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-60118
Vulnerability Analysis
The PGS Core plugin fails to properly sanitize user-controlled input before incorporating it into SQL statements. Attacker-supplied data is concatenated into query strings without parameterization or escaping. This allows an attacker with at least low privileges on the WordPress site to inject arbitrary SQL syntax. Because the CVSS scope is changed, injected queries can reach data outside the plugin's own logical boundary, including core WordPress tables such as wp_users and wp_options.
Exploitation does not require user interaction and can be performed remotely over HTTP/HTTPS. The impact profile prioritizes confidentiality, with limited availability impact, suggesting that injected payloads can read sensitive records and trigger query failures that disrupt plugin functionality.
Root Cause
The root cause is missing input neutralization in one or more plugin endpoints that build SQL statements dynamically. Developers passed request parameters directly into database queries without using WordPress's $wpdb->prepare() API or equivalent parameterized query mechanisms. This is a classic instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Attack Vector
An attacker authenticates to the target WordPress site with a low-privileged account such as Subscriber or Contributor, depending on the affected endpoint. The attacker then issues an HTTP request to a vulnerable plugin handler containing SQL metacharacters in a parameter that is inserted into a query. Typical payloads include UNION SELECT statements to exfiltrate data from arbitrary tables, or boolean-based blind techniques where direct output is not returned. Refer to the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-60118
Indicators of Compromise
- HTTP requests to PGS Core plugin endpoints containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP(
- Unexpected database errors logged by WordPress or MySQL referencing the plugin's query paths
- Outbound queries returning unusually large result sets or accessing tables outside the plugin scope
- New or modified administrator accounts in wp_users without corresponding audit trail entries
Detection Strategies
- Inspect web server access logs for requests to pgs-core handlers containing URL-encoded SQL syntax
- Enable MySQL general query logging temporarily to capture queries originating from plugin code paths
- Deploy a Web Application Firewall (WAF) ruleset that flags SQLi signatures targeting WordPress plugins
- Correlate authenticated low-privilege sessions with database error spikes using SIEM analytics
Monitoring Recommendations
- Forward WordPress and MySQL logs into a centralized data lake for query-pattern analytics and retention
- Alert on UNION SELECT, INFORMATION_SCHEMA, and time-based payload patterns in HTTP query strings and POST bodies
- Monitor for privilege escalation events, including new administrator role assignments following plugin requests
How to Mitigate CVE-2025-60118
Immediate Actions Required
- Identify all WordPress installations running PGS Core version 5.9.0 or earlier using plugin inventory scans
- Restrict access to the WordPress admin interface and authenticated endpoints from untrusted networks
- Audit wp_users and recent posts for unauthorized changes that may indicate prior exploitation
- Rotate WordPress administrator passwords and secret keys defined in wp-config.php
Patch Information
At the time of NVD publication, the vulnerability affects PGS Core through version 5.9.0. Site operators should consult the vendor and the Patchstack advisory for the fixed release version and upgrade immediately once available. Until a patched version is installed, treat affected sites as exposed.
Workarounds
- Deactivate and remove the PGS Core plugin until a fixed version is installed
- Deploy virtual patching through a WAF with SQL injection rules tuned for WordPress plugin endpoints
- Limit account registration and demote unnecessary low-privilege accounts to reduce the authenticated attack surface
- Enforce least-privilege database credentials for WordPress, removing FILE, CREATE, and DROP rights where not needed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
