CVE-2025-14124

The Team WordPress plugin before version 5.0.11 contains an unauthenticated SQL injection vulnerability. The plugin fails to properly sanitize and escape a parameter before using it in a SQL statement within an AJAX action that is available to unauthenticated users [1]. This allows an attacker to inject arbitrary SQL commands.

An attacker can exploit this vulnerability by sending a crafted AJAX request to the vulnerable endpoint without needing any authentication. The lack of input sanitization means the attacker can manipulate the SQL query executed by the plugin [1].

Successful exploitation could allow an unauthenticated attacker to extract sensitive data from the database, such as user credentials or other private information. Depending on the database configuration, it might also be possible to modify or delete data [1].

The vulnerability has been fixed in version 5.0.11 of the plugin. Users are strongly advised to update to the latest version to mitigate the risk [1].