SQL Injection Vulnerability in ProfileGrid Plugin for WordPress
CVE-2025-0723
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 March 2025
What is CVE-2025-0723?
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress has a security vulnerability that allows authenticated users, with Subscriber access and above, to perform blind and time-based SQL injections via the rid and search parameters. This occurs due to inadequate escaping of user-supplied input and insufficient preparation in existing SQL queries. Exploiting this vulnerability could enable attackers to append malicious SQL queries to existing ones, potentially leading to unauthorized access to sensitive database information.
Affected Version(s)
ProfileGrid – User Profiles, Groups and Communities * <= 5.9.4.7