CVE-2025-7826: WordPress Testimonial Plugin SQLi Vulnerability

CVE-2025-7826 Overview

CVE-2025-7826 is a SQL Injection vulnerability [CWE-89] affecting the Testimonial plugin for WordPress (also known as indianic-testimonial). The flaw exists in all versions up to and including 2.3. It stems from insufficient escaping of a user-supplied parameter in the iNICtestimonial shortcode, combined with a lack of parameterized query preparation. Authenticated attackers with Contributor-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials, session tokens, and configuration data.

Critical Impact
Authenticated Contributor-level users can extract arbitrary data from the WordPress database by injecting SQL through the iNICtestimonial shortcode.

Affected Products

WordPress Testimonial plugin (indianic-testimonial) versions ≤ 2.3
WordPress sites permitting Contributor-level or higher account registration with the plugin installed
Multi-author WordPress environments using the vulnerable shortcode

Discovery Timeline

2025-09-10 - CVE-2025-7826 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7826

Vulnerability Analysis

The vulnerability resides in the iNICtestimonial shortcode handler shipped with the Testimonial plugin. The shortcode accepts a user-controlled attribute that is concatenated directly into a SQL query executed against the WordPress database. Because the plugin does not escape the input with esc_sql() and does not use wpdb::prepare() with placeholders, injected SQL fragments become part of the executed statement.

An authenticated attacker with Contributor-level access can embed the shortcode inside a draft post or page. When WordPress renders the shortcode, the injected SQL executes with the privileges of the database user configured for WordPress. This exposes stored data through UNION-based or time-based blind SQL injection techniques.

Exploitation targets confidentiality only. The vulnerability does not directly enable data modification or denial of service, though extracted wp_users password hashes can be used for offline cracking and follow-on account takeover.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The shortcode callback interpolates the attribute value into the query string rather than binding it as a parameter through the $wpdb->prepare() API. WordPress documentation explicitly requires prepared statements for any query incorporating user input.

Attack Vector

The attack requires network access to the WordPress site and an authenticated session with at least Contributor privileges. The attacker creates or edits a post containing the iNICtestimonial shortcode with a malicious attribute value. Rendering the post triggers the vulnerable query. No user interaction beyond page render is required. Refer to the Wordfence Vulnerability Report #840fefde for additional technical context.

Detection Methods for CVE-2025-7826

Indicators of Compromise

Draft or published posts authored by Contributor accounts containing the [iNICtestimonial] shortcode with unusual attribute payloads
WordPress debug.log entries showing SQL syntax errors originating from the plugin
Unexpected SELECT ... UNION SELECT or SLEEP() patterns in database query logs tied to the plugin's table
New or recently promoted Contributor accounts with immediate shortcode activity

Detection Strategies

Enable MySQL general query logging temporarily and search for queries referencing the Testimonial plugin table joined with information_schema or wp_users
Deploy WAF rules that flag SQL metacharacters within shortcode attributes in POST bodies to /wp-admin/post.php
Audit wp_posts for shortcode instances containing UNION, SLEEP, BENCHMARK, or comment sequences such as -- and /*

Monitoring Recommendations

Alert on Contributor and Author accounts editing posts that render shortcodes tied to database lookups
Monitor for sudden spikes in database response latency correlated with post preview requests
Track outbound authentication failures that may indicate cracked hashes extracted via injection

How to Mitigate CVE-2025-7826

Immediate Actions Required

Deactivate and remove the Testimonial plugin (indianic-testimonial) until a patched version is confirmed available
Audit all Contributor, Author, Editor, and Administrator accounts and disable any that are unrecognized
Rotate WordPress user passwords and secret keys defined in wp-config.php if injection activity is suspected
Review recent posts and revisions for the iNICtestimonial shortcode with suspicious attribute payloads

Patch Information

No fixed version is listed in the NVD entry at time of publication. Versions up to and including 2.3 remain vulnerable. Monitor the plugin page on WordPress.org and the Wordfence advisory for update availability.

Workarounds

Restrict shortcode usage by removing the shortcode registration via a mu-plugin: remove_shortcode('iNICtestimonial');
Limit Contributor-level account creation and require administrative approval for new registrations
Place the WordPress admin interface behind IP allowlisting or an authentication proxy to reduce exposure
Deploy a Web Application Firewall with SQL injection signatures covering shortcode attribute injection

bash

# Configuration example: disable the vulnerable shortcode via mu-plugin
cat > /var/www/html/wp-content/mu-plugins/disable-inic-testimonial.php <<'PHP'
<?php
add_action('init', function () {
    remove_shortcode('iNICtestimonial');
}, 20);
PHP