SQL Injection Vulnerability in Simple Download Monitor Plugin for WordPress

CVE-2025-8977

What is CVE-2025-8977?

The Simple Download Monitor plugin for WordPress is susceptible to a time-based SQL injection attack through the order parameter in versions up to 3.9.33. This occurs due to inadequate escaping of user-supplied input and a lack of sufficient query preparation. Malicious actors with Contributor-level access or higher can exploit this vulnerability to insert additional SQL queries into existing queries. This manipulation can ultimately enable unauthorized access to sensitive information within the database.

References