Cross-Site Request Forgery in EZ SQL Reports Shortcode Widget and DB Backup for WordPress

CVE-2025-2319

What is CVE-2025-2319?

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is susceptible to Cross-Site Request Forgery. This vulnerability arises from inadequate nonce validation within the 'ELISQLREPORTS_menu' function, allowing unauthenticated attackers to potentially execute unauthorized commands on the server. By deceiving a site administrator into clicking a malicious link, an attacker could exploit this vulnerability. The issue is mitigated in version 5.25.10, which introduces necessary nonce checks, limiting exploitation to admin users only.

References