CVE-2025-14477

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14477", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T18:34:36.010Z", "datePublished": "2025-12-13T03:20:24.348Z", "dateUpdated": "2026-04-08T16:46:32.501Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:32.501Z"}, "affected": [{"vendor": "aaron13100", "product": "404 Solution", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the `filterText` parameter in the `ajaxUpdatePaginationLinks` AJAX action. The sanitization logic can be bypassed by using the sequence `*$/` which becomes `*/` after the `$` character is removed, allowing attackers to escape SQL comment contexts. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind SQL injection technique."}], "title": "404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/389bee79-b59f-484a-86df-f041d6b00051?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L977"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L987"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/PluginLogic.php#L1595"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/sql/getRedirectsForView.sql#L106"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417333%40404-solution&new=3417333%40404-solution&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhamad Visat Sutarno"}], "timeline": [{"time": "2025-12-11T08:26:20.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-12T15:01:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:44:01.558067Z", "id": "CVE-2025-14477", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:49:21.140Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14477", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:44:01.558067Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:44:02.920Z"}}], "cna": {"title": "404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhamad Visat Sutarno"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "aaron13100", "product": "404 Solution", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T08:26:20.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-12T15:01:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/389bee79-b59f-484a-86df-f041d6b00051?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L977"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L987"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/PluginLogic.php#L1595"}, {"url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/sql/getRedirectsForView.sql#L106"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417333%40404-solution&new=3417333%40404-solution&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the `filterText` parameter in the `ajaxUpdatePaginationLinks` AJAX action. The sanitization logic can be bypassed by using the sequence `*$/` which becomes `*/` after the `$` character is removed, allowing attackers to escape SQL comment contexts. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind SQL injection technique."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-13T03:20:24.348Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14477", "state": "PUBLISHED", "dateUpdated": "2025-12-15T15:49:21.140Z", "dateReserved": "2025-12-10T18:34:36.010Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T03:20:24.348Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "404 Solution", "vendor": "aaron13100", "versions": [{"lessThanOrEqual": "3.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The 404 Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This is due to improper sanitization of the `filterText` parameter in the `ajaxUpdatePaginationLinks` AJAX action. The sanitization logic can be bypassed by using the sequence `*$/` which becomes `*/` after the `$` character is removed, allowing attackers to escape SQL comment contexts. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind SQL injection technique."}, {"lang": "es", "value": "El plugin 404 Solution para WordPress es vulnerable a inyecci\u00f3n SQL en todas las versiones hasta la 3.1.0, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto se debe a una sanitizaci\u00f3n incorrecta del par\u00e1metro 'filterText' en la acci\u00f3n AJAX 'ajaxUpdatePaginationLinks'. La l\u00f3gica de sanitizaci\u00f3n puede ser eludida utilizando la secuencia '*$/' que se convierte en '*/' despu\u00e9s de que se elimina el car\u00e1cter '$', permitiendo a los atacantes escapar contextos de comentarios SQL. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador o superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos a trav\u00e9s de una t\u00e9cnica de inyecci\u00f3n SQL ciega basada en tiempo."}], "id": "CVE-2025-14477", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14477", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:44:01.558067Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:50.793", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L977"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/DataAccess.php#L987"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/PluginLogic.php#L1595"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/404-solution/tags/2.36.10/includes/sql/getRedirectsForView.sql#L106"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417333%40404-solution&new=3417333%40404-solution&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/389bee79-b59f-484a-86df-f041d6b00051?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:18:20.910189+00:00", "value": {"mitigation_remediation": ["Update the 404 Solution plugin to the latest release (v3.1.1 or newer).", "If an update is not feasible, disable or remove the 404 Solution plugin entirely to eliminate the vulnerable endpoints.", "Deploy input validation or sanitization on the filterText parameter or block the ajaxUpdatePaginationLinks action through web\u2011application firewall rules."], "summary": {"action": "Immediate Patch", "impact": "Confidentiality Breach via Authenticated SQL Injection"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the 404 Solution plugin version 3.1.0 or older. The vulnerability exists in all releases up to and including 3.1.0. The affected vendor is aaron13100:404 Solution. Administrators with access to the site\u2019s back\u2011end or authorized users of the AJAX endpoint are the relevant user class.", "description_and_impact": "The 404 Solution WordPress plugin allows an injected query through the filterText parameter used by the ajaxUpdatePaginationLinks action. Improper escaping and a bypass of the sanitization logic enable an attacker with administrator level access to append arbitrary SQL statements. The resulting time\u2011based blind injection can be used to extract sensitive data from the database, compromising confidentiality. This flaw is a classic SQL Injection weakness cataloged as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 4.9 indicates a moderate security impact. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with administrative privileges and to be able to send crafted requests to the ajaxUpdatePaginationLinks endpoint. The attacker can then inject and execute additional SQL statements, creating a potential data exfiltration vector."}}}}, "created": "2025-12-14T21:14:46.655865+00:00", "updated": "2026-04-21T17:30:37.684960+00:00", "vendors": ["aaron13100", "aaron13100$PRODUCT$404_solution", "wordpress", "wordpress$PRODUCT$wordpress"]}