Time-Based SQL Injection Vulnerability in WPNakama Plugin for WordPress
CVE-2025-14068

7.5HIGH

Key Information:

Vendor

WordPress
Status
WPnakama – Team And Multi-client Collaboration, Editorial And Project Management
Vendor
CVE Published:
12 December 2025

What is CVE-2025-14068?

The WPNakama plugin for WordPress is susceptible to a time-based SQL Injection attack via the 'order_by' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. An attacker with no authentication can exploit this flaw to insert arbitrary SQL queries, potentially leading to unauthorized data extraction from the database. Users of the plugin should take immediate steps to update to the latest version and implement security best practices to protect against such vulnerabilities.

Affected Version(s)

WPNakama – Team and multi-Client Collaboration, Editorial and Project Management * <= 0.6.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpnakama/trunk...
https://plugins.trac.wordpress.org/browser/wpnakama/tags/...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn
Itthidej Aramsri
Powpy
Waris Damkham
Varakorn Chanthasri
Peerapat Samatathanyakorn
Sopon Tangpathum (SoNaJaa)
JSON
.
CVE-2025-14068 : Time-Based SQL Injection Vulnerability in WPNakama Plugin for WordPress