CVE-2025-7826

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7826", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-18T18:49:59.223Z", "datePublished": "2025-09-10T06:38:48.287Z", "dateUpdated": "2026-04-08T17:04:18.688Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:18.688Z"}, "affected": [{"vendor": "laki_patel", "product": "Testimonial", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/840fefde-8c9d-413f-a6a6-1e796fb9e910?source=cve"}, {"url": "https://wordpress.org/plugins/indianic-testimonial/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "timeline": [{"time": "2025-09-09T17:41:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T14:14:13.204227Z", "id": "CVE-2025-7826", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:14:18.407Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7826", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T14:14:13.204227Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T20:29:32.684Z"}}], "cna": {"title": "Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "laki_patel", "product": "Testimonial", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-09T17:41:44.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/840fefde-8c9d-413f-a6a6-1e796fb9e910?source=cve"}, {"url": "https://wordpress.org/plugins/indianic-testimonial/"}], "descriptions": [{"lang": "en", "value": "The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-10T06:38:48.287Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7826", "state": "PUBLISHED", "dateUpdated": "2025-11-25T14:14:18.407Z", "dateReserved": "2025-07-18T18:49:59.223Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-10T06:38:48.287Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Testimonial", "vendor": "laki_patel", "versions": [{"lessThanOrEqual": "2.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2025-7826", "lastModified": "2026-06-17T10:05:44.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7826", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T14:14:13.204227Z", "version": "2.0.3"}}]}, "published": "2025-09-10T07:15:45.413", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/indianic-testimonial/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/840fefde-8c9d-413f-a6a6-1e796fb9e910?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:08:43.887939+00:00", "value": {"mitigation_remediation": ["Upgrade the Testimonial plugin to version 2.4 or newer, or any release that addresses the injected input handling issue.", "If an upgrade is not immediately possible, remove or disable the iNICtestimonial shortcode from frontend pages until a patch is applied.", "Restrict Contributor+ roles from using the shortcode by modifying role capabilities or applying a content filtering rule that blocks the iNICtestimonial parameter from being processed."], "summary": {"action": "Patch Plugin", "impact": "Data Exfiltration via SQL Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Testimonial plugin version 2.3 and all earlier releases. These versions are distributed on the WordPress plugin repository and also consumed by users of WordPress sites that have installed the plugin. Any site running an affected version of Testimonial is at risk. The plugin is identified by the vendor \"laki_patel\" under the product name \"Testimonial\".", "description_and_impact": "The Testimonial plugin for WordPress contains a SQL injection vulnerability in the iNICtestimonial shortcode. The lack of proper escaping and prepared statements allows an authenticated user with Contributor-level access or higher to inject arbitrary SQL statements. The injected code could read sensitive data stored in the database, such as user credentials, personal information, or other confidential content. This vulnerability is classified as CWE-89.", "risk_and_exploitability": "The CVSS score is 6.5, indicating a moderate severity. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but still possible, especially in targeted attacks. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access, so a malicious contributor or higher role that has the ability to insert content can exploit the flaw by crafting a malicious value for the shortcode parameter. Once exploited, an attacker could read data from the database by appending additional SELECT statements."}}}}, "created": "2025-09-11T10:42:52.539586+00:00", "updated": "2026-04-21T03:15:16.332665+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}