SQL Injection Vulnerability in WP-Recall Plugin by WordPress

CVE-2025-1323

Summary

The WP-Recall plugin, utilized for registration, profile management, commerce, and more, is susceptible to SQL injection attacks. An attacker can exploit the vulnerability through the 'databeat' parameter, which lacks adequate escaping and preparation in its SQL query handling. This deficiency allows unauthorized users to inject malicious SQL code, potentially exposing sensitive database information. It is crucial for users to address this vulnerability by updating to the latest version of the plugin and implementing robust security practices to safeguard against such attacks.

References