SQL Injection Vulnerability in Custom 404 Pro Plugin for WordPress

CVE-2025-9947

What is CVE-2025-9947?

The Custom 404 Pro plugin for WordPress contains a vulnerability that allows for time-based SQL injection through the 'path' parameter. This issue arises from inadequate escaping of user-supplied data and insufficiently prepared SQL queries. Authenticated attackers with Administrator-level access can exploit this flaw to inject additional SQL queries into existing ones, potentially gaining unauthorized access to sensitive database information. Website owners using affected versions should prioritize updating their plugins to secure their systems.

References