CVE-2025-11980

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11980", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T17:48:53.466Z", "datePublished": "2025-11-08T09:28:09.878Z", "dateUpdated": "2026-04-08T16:54:40.883Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:40.883Z"}, "affected": [{"vendor": "kybernetikservices", "product": "Quick Featured Images", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "13.7.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted they can convince an author-level user or higher to add a malicious custom field value."}], "title": "Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/590720a3-1881-4a5d-b004-ad92d386afe6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L817"}, {"url": "https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L785"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388701%40quick-featured-images&new=3388701%40quick-featured-images&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-11-07T21:03:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T14:07:22.962777Z", "id": "CVE-2025-11980", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T14:13:59.718Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T14:07:22.962777Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T14:07:23.795Z"}}], "cna": {"title": "Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "kybernetikservices", "product": "Quick Featured Images", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "13.7.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-07T21:03:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/590720a3-1881-4a5d-b004-ad92d386afe6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L817"}, {"url": "https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L785"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388701%40quick-featured-images&new=3388701%40quick-featured-images&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted they can convince an author-level user or higher to add a malicious custom field value."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:40.883Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11980", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:40.883Z", "dateReserved": "2025-10-20T17:48:53.466Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T09:28:09.878Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quick Featured Images", "vendor": "kybernetikservices", "versions": [{"lessThanOrEqual": "13.7.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted they can convince an author-level user or higher to add a malicious custom field value."}, {"lang": "es", "value": "El plugin Quick Featured Images para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de la funci\u00f3n 'delete_orphaned' en todas las versiones hasta la 13.7.3, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel Editor o superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden usarse para extraer informaci\u00f3n sensible de la base de datos, siempre que puedan convencer a un usuario de nivel autor o superior para que a\u00f1ada un valor de campo personalizado malicioso."}], "id": "CVE-2025-11980", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11980", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T14:07:22.962777Z", "version": "2.0.3"}}]}, "published": "2025-11-08T10:15:40.887", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L785"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L817"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388701%40quick-featured-images&new=3388701%40quick-featured-images&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/590720a3-1881-4a5d-b004-ad92d386afe6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:29:19.686878+00:00", "value": {"mitigation_remediation": ["Update Quick Featured Images to the latest version (13.8 or newer) to address the SQL injection flaw.", "If an update is not immediately possible, restrict access to the delete_orphaned functionality by limiting usage to administrators only or by disabling the feature via plugin settings or code hooks.", "Audit any custom field values entered by editors and authors, and remove or sanitize any suspicious entries that could be used to inject SQL.", "Monitor database logs for unexpected queries originating from the plugin and review role assignments to ensure only trusted users have Editor or higher privileges."], "summary": {"action": "Patch", "impact": "SQL Injection leading to data exposure"}, "threat_synthesis": {"affected_systems": "Kybernetik Services\u2019 Quick Featured Images plugin, all releases up to and including version 13.7.3. No other vendors or product versions are listed as affected.", "description_and_impact": "The vulnerability exists in the Quick Featured Images WordPress plugin, where the delete_orphaned function fails to properly escape user\u2011supplied data, allowing an authenticated user with Editor level or higher access to inject arbitrary SQL statements. This can result in sensitive information being extracted from the database or other unintended database modifications. The impact is data exposure rather than remote code execution.", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The plugin is not listed in the CISA KEV catalog. Exploitability requires an attacker to be logged in with at least Editor privileges and to convince a higher\u2011privileged user to insert a malicious custom field value, after which the attacker can append SQL statements. The requirement for social engineering lowers the likelihood, but the potential to read or manipulate database contents remains a concern for sites with sensitive data."}}}}, "created": "2025-11-10T09:33:26.455398+00:00", "updated": "2026-04-22T12:30:16.837458+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}