SQL Injection Vulnerability in Squirrly SEO Plugin for WordPress

CVE-2025-1768

Summary

The Squirrly SEO Plugin for WordPress contains a vulnerability that allows for blind SQL Injection through the 'search' parameter across all versions up to and including 12.4.05. This issue arises from inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. As a result, authenticated attackers with Subscriber-level access or higher can craft additional SQL queries to manipulate the original queries. This can lead to the unauthorized disclosure of sensitive information stored in the database, heightening the risk of exploitation and compromising the security of affected WordPress sites.

References