SQL Injection Vulnerability in External Login Plugin for WordPress

CVE-2025-11177

What is CVE-2025-11177?

The External Login plugin for WordPress has a vulnerability that allows SQL Injection through the 'log' parameter. This occurs due to inadequate escaping of user input and poor handling of SQL queries. Unauthenticated attackers can exploit this weakness to inject malicious SQL commands, enabling them to extract sensitive information from the database, particularly if PostgreSQL or MSSQL is used for external authentication.

References