The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5. This vulnerability arises from insufficient escaping on user-supplied parameters and a lack of adequate preparation on the existing SQL query, allowing unauthenticated attackers to append additional SQL queries to extract sensitive information from the database.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-7670 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted SQL queries through the vulnerable build_sql_where() function. By manipulating the user-supplied parameters, the attacker can execute arbitrary SQL commands, potentially leading to the extraction of sensitive data from the database without any authentication.
Affected Products
- JS Archive List plugin for WordPress (all versions up to and including 6.1.5) – vulnerable to SQL injection due to insufficient input validation.
Mitigation
To mitigate this vulnerability, it is recommended to update the JS Archive List plugin to the latest version where the issue has been addressed. Additionally, implementing proper input validation and prepared statements can help prevent SQL injection attacks in the future.