CVE-2025-26974

The WP Multistore Locator plugin for WordPress, versions 2.5.1 and earlier, contains a critical blind SQL injection vulnerability. The root cause is improper neutralization of special elements used in an SQL command, specifically within a query parameter. This allows an attacker to inject arbitrary SQL statements without requiring authentication.

The vulnerability is exploitable remotely and does not require any user interaction or privileges. An attacker can send crafted HTTP requests to the vulnerable parameter, performing blind SQL injection to extract information character by character. The attack surface is broad, as it targets a widely installed plugin, potentially affecting thousands of sites.

Successful exploitation could allow a malicious actor to directly interact with the database, leading to data theft, including sensitive user information. The CVSS score of 9.3 highlights the high impact on confidentiality, integrity, and availability. The vulnerability is expected to be used in mass-exploit campaigns.

The vendor has released version 2.5.2 to patch this issue. Users are strongly advised to update immediately. For those unable to update, a mitigation rule is available from Patchstack to block attacks. The vulnerability is also listed as highly dangerous and likely to be exploited [1].