CVE-2025-67517

Vulnerability

Description The ArtPlacer Widget plugin for WordPress versions up to and including 2.22.9.2 contains a blind SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. This allows an attacker to inject malicious SQL queries through the plugin's input fields.

Exploitation

According to the advisory [1], this type of vulnerability is often used in mass-exploit campaigns, indicating that exploitation can be performed remotely without requiring authentication. An attacker can send crafted HTTP requests containing SQL payloads to trigger the blind injection, gradually extracting information from the database.

Impact

Successful exploitation enables an attacker to directly interact with the WordPress database, potentially stealing sensitive data such as user credentials, post content, and other configuration details. The CVSS score of 8.5 reflects the high risk of data compromise.

Mitigation

The vulnerability is addressed in version 2.23 of the ArtPlacer Widget plugin. Users are strongly advised to update immediately to protect their sites. For those who cannot update immediately, consulting with a hosting provider or developer for temporary workarounds is recommended [1].