The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5. This vulnerability arises from insufficient escaping on user-supplied parameters and a lack of preparation on the existing SQL query, allowing unauthenticated attackers to append additional SQL queries to extract sensitive information from the database.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7670 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted SQL queries through the vulnerable build_sql_where() function. By manipulating the user-supplied parameters, the attacker can execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data stored in the database.
Affected Products
- JS Archive List Plugin for WordPress (versions up to 6.1.5): A plugin that allows users to display a list of archives on their WordPress site, which is now vulnerable to SQL injection attacks.
Mitigation
To mitigate this vulnerability, users should update the JS Archive List plugin to the latest version that addresses the SQL injection issue. Additionally, implementing proper input validation and parameterized queries can help prevent similar vulnerabilities in the future.