CVE-2025-6717: B1.lt WordPress Plugin SQL Injection Flaw

CVE-2025-6717 Overview

CVE-2025-6717 is a SQL injection vulnerability in the B1.lt plugin for WordPress. The flaw affects all versions up to and including 2.2.56. The plugin fails to properly escape the id parameter and does not sufficiently prepare the SQL query that consumes it.

Authenticated attackers with Subscriber-level access or higher can append additional SQL statements to the existing query. Successful exploitation allows extraction of sensitive data from the WordPress database, including user records and credentials.

Critical Impact
Authenticated attackers with low-privilege Subscriber accounts can exfiltrate confidential database contents through crafted id parameter values.

Affected Products

B1.lt WordPress plugin (b1-accounting) versions through 2.2.56
WordPress sites with the B1.lt plugin installed and active
Any user role at Subscriber level or above can trigger the vulnerable code path

Discovery Timeline

2025-07-18 - CVE-2025-6717 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6717

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the B1.lt plugin's handling of the id request parameter. The plugin incorporates the user-supplied value directly into a SQL query without parameterized statements or sufficient escaping.

An authenticated attacker crafts a request containing a specially formed id value. The server concatenates that value into an existing SQL statement, allowing the attacker to inject additional clauses such as UNION SELECT. The injected query runs under the database privileges of the WordPress site, which typically has full access to the wp_users and wp_usermeta tables.

Because the attack requires only a Subscriber account, exposure is high on sites that permit open registration. Confidentiality impact is high while integrity and availability are not affected by this flaw.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The plugin accepts the id parameter from the HTTP request and inserts it into a query without using $wpdb->prepare() placeholders. Insufficient escaping compounds the issue by allowing SQL metacharacters to break out of the intended query context.

Attack Vector

The attack is remote and network-based. An attacker authenticates to the target WordPress site with any role at Subscriber level or higher. The attacker then sends a crafted HTTP request to the vulnerable plugin endpoint, supplying a malicious payload in the id parameter. The injected SQL is executed by the backend, returning database contents in the response or through blind inference. No user interaction is required beyond the attacker's own session.

For technical validation details, see the Wordfence Vulnerability Report and the WordPress Plugin Change Log.

Detection Methods for CVE-2025-6717

Indicators of Compromise

Unusual HTTP requests to B1.lt plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the id parameter
Spikes in authenticated requests from newly registered Subscriber accounts
Database query log entries showing malformed or multi-statement queries originating from the plugin
Outbound data transfers correlated with plugin request bursts

Detection Strategies

Inspect web server access logs for query strings targeting b1-accounting paths with suspicious id values
Enable MySQL general query log or slow query log temporarily to capture injected statements
Deploy a web application firewall rule that blocks SQL metacharacters in the id parameter for plugin endpoints
Correlate low-privilege user sessions with unexpected read access patterns across sensitive tables

Monitoring Recommendations

Monitor creation of new Subscriber accounts followed by immediate plugin interaction
Alert on HTTP 500 responses from plugin endpoints that may indicate failed injection attempts
Track query volume and response size anomalies on the WordPress database host

How to Mitigate CVE-2025-6717

Immediate Actions Required

Update the B1.lt plugin to a version later than 2.2.56 as soon as the vendor publishes a fixed release
Audit WordPress user accounts and remove untrusted Subscriber-level users
Disable open registration on sites that do not require it
Review database access logs for signs of prior exploitation and rotate any exposed credentials

Patch Information

Refer to the B1 Accounting Plugin Overview and the WordPress Plugin Change Log for the current release and changeset details. Apply the latest version through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate and remove the B1.lt plugin until a patched version is confirmed installed
Deploy a web application firewall rule that rejects SQL metacharacters in requests to b1-accounting endpoints
Restrict access to the plugin's endpoints at the reverse proxy to known administrator IP addresses

bash

# Update the plugin via WP-CLI once a fixed release is published
wp plugin update b1-accounting

# Or temporarily deactivate the plugin
wp plugin deactivate b1-accounting