CVE-2025-2106

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2106", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-07T19:59:41.196Z", "datePublished": "2025-03-13T01:45:26.824Z", "dateUpdated": "2026-04-08T16:56:40.054Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:40.054Z"}, "affected": [{"vendor": "arielbrailovsky", "product": "ArielBrailovsky-ViralAd", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress."}], "title": "Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60cd2178-858e-4e24-8967-13b04f675d2d?source=cve"}, {"url": "https://wordpress.org/plugins/arielbrailovsky-viralad/"}, {"url": "https://plugins.trac.wordpress.org/browser/arielbrailovsky-viralad/trunk/inc/anuncio.php#L174"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "siyuan shao"}], "timeline": [{"time": "2025-03-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-14T13:55:42.881712Z", "id": "CVE-2025-2106", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T13:55:51.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2106", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-14T13:55:42.881712Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T13:55:47.471Z"}}], "cna": {"title": "Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "siyuan shao"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "arielbrailovsky", "product": "ArielBrailovsky-ViralAd", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60cd2178-858e-4e24-8967-13b04f675d2d?source=cve"}, {"url": "https://wordpress.org/plugins/arielbrailovsky-viralad/"}, {"url": "https://plugins.trac.wordpress.org/browser/arielbrailovsky-viralad/trunk/inc/anuncio.php#L174"}], "descriptions": [{"lang": "en", "value": "The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:40.054Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2106", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:40.054Z", "dateReserved": "2025-03-07T19:59:41.196Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-13T01:45:26.824Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ArielBrailovsky-ViralAd", "vendor": "arielbrailovsky", "versions": [{"lessThanOrEqual": "1.0.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress."}, {"lang": "es", "value": "El complemento ArielBrailovsky-ViralAd para WordPress es vulnerable a la inyecci\u00f3n SQL mediante los par\u00e1metros \"text\" e \"id\" de la funci\u00f3n limpia() en todas las versiones hasta la 1.0.8 incluida, debido a un escape insuficiente del par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n de la consulta SQL existente. Esto permite a atacantes no autenticados a\u00f1adir consultas SQL adicionales a las consultas ya existentes, las cuales pueden utilizarse para extraer informaci\u00f3n confidencial de la base de datos. Esto solo parece ser explotable en versiones muy antiguas de WordPress."}], "id": "CVE-2025-2106", "lastModified": "2026-06-17T09:06:20.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2106", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-14T13:55:42.881712Z", "version": "2.0.3"}}]}, "published": "2025-03-13T02:15:13.097", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/arielbrailovsky-viralad/trunk/inc/anuncio.php#L174"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/arielbrailovsky-viralad/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60cd2178-858e-4e24-8967-13b04f675d2d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:58:58.417688+00:00", "value": {"mitigation_remediation": ["Update the ArielBrailovsky\u2011ViralAd plugin to the latest release or uninstall it if it is no longer maintained.", "If a patch is unavailable, modify the plugin\u2019s code to use parameterized queries (e.g., $wpdb->prepare) for the 'text' and 'id' parameters, ensuring all user input is properly escaped.", "Disable unauthenticated access to the plugin\u2019s front\u2011end scripts or remove the vulnerable functionality entirely, for example by restricting the endpoint to authenticated administrators or by deleting the plugin if it is not needed.", "Harden the WordPress installation by restricting database user privileges to the minimal necessary permissions and by ensuring that only administrators can reach plugin admin pages."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized data extraction via SQL injection"}, "threat_synthesis": {"affected_systems": "All releases of the ArielBrailovsky\u2011ViralAd WordPress plugin up to version 1.0.8 are affected. The vulnerability is only exploitable on very old WordPress installations that still use legacy database schemas or older PHP versions. Newer WordPress cores and the plugin\u2019s later releases eliminate the issue by using proper query preparation.", "description_and_impact": "The ArielBrailovsky\u2011ViralAd plugin contains an SQL injection flaw (CWE\u201189) in the limpia() function. Unsanitized 'text' and 'id' parameters allow attackers to inject arbitrary SQL statements, enabling arbitrary query execution. Because the injection is unauthenticated, any visitor can trigger it, potentially extracting sensitive data such as user credentials, content, or site configuration from the WordPress database.", "risk_and_exploitability": "The CVSS score of 7.5 categorizes this flaw as high, yet the EPSS score of <1% indicates a low overall exploitation probability. The flaw is not listed in CISA\u2019s KEV catalogue. Attackers need only a simple web request to the plugin\u2019s endpoint; because authentication is not required, exploitation is straightforward, but the primary impact is data leakage rather than direct remote code execution, unless coupled with additional vulnerabilities."}}}}, "created": "2026-04-21T22:00:26.601462+00:00", "updated": "2026-04-21T22:00:26.601479+00:00", "vendors": []}