CVE-2025-2106
Description
The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SQL injection in ArielBrailovsky-ViralAd WordPress plugin allows unauthenticated attackers to extract database info; plugin closed and no fix.
The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL injection in all versions up to and including 1.0.8. The vulnerability exists in the limpia() function, which fails to properly escape user-supplied input passed via the 'text' and 'id' parameters and lacks sufficient preparation of the SQL query. This flaw allows an attacker to inject additional SQL statements into existing queries [1].
Exploitation does not require authentication, as the vulnerable function is accessible to unauthenticated users. However, the issue is reportedly exploitable only on very old versions of WordPress, limiting its applicability [1].
An attacker can leverage this SQL injection to extract sensitive information from the database, such as user credentials or private data, by appending malicious SQL queries [1].
No patch is available as the plugin has been closed on March 11, 2025, and is no longer distributed. Users are advised to remove the plugin immediately to mitigate the risk [1].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.