CVE-2025-0861 identifies a SQL Injection vulnerability in the VR-Frases (collect & share quotes) WordPress plugin developed by vruizg. This vulnerability affects all versions up to and including 3.0.1. The root cause is insufficient escaping of user-supplied parameters and the absence of prepared statements in the plugin's SQL queries. This improper neutralization of special elements (CWE-89) allows an unauthenticated attacker to append arbitrary SQL commands to existing queries. As a result, attackers can extract sensitive information from the backend database, such as user data or site configuration details. The vulnerability is remotely exploitable without user interaction, increasing its risk profile. Despite the moderate CVSS score of 4.9, the impact on confidentiality is high, while integrity and availability are not affected. No patches or official fixes are currently linked, and no known exploits have been observed in the wild. The vulnerability was published on January 30, 2025, and assigned by Wordfence. Given the widespread use of WordPress and its plugins, this vulnerability could be leveraged in targeted attacks against vulnerable sites.

The primary impact of this vulnerability is unauthorized disclosure of sensitive database information, which can include user credentials, personal data, or other confidential content stored by the affected WordPress site. This can lead to privacy violations, reputational damage, and potential compliance issues for organizations. Although the vulnerability does not affect data integrity or availability, the exposure of sensitive data can facilitate further attacks such as credential stuffing, phishing, or privilege escalation. Since the exploit requires no authentication or user interaction, attackers can automate exploitation attempts at scale. Organizations running the VR-Frases plugin on publicly accessible WordPress sites are at risk, especially if they have not applied any mitigations. The lack of known exploits in the wild currently reduces immediate risk, but the vulnerability remains a significant concern until patched.

To mitigate this vulnerability, organizations should immediately audit their WordPress installations for the presence of the VR-Frases plugin and its version. If possible, update the plugin to a fixed version once released by the vendor. In the absence of an official patch, administrators should consider disabling or uninstalling the plugin to eliminate the attack surface. Applying Web Application Firewall (WAF) rules that detect and block SQL Injection patterns targeting the plugin’s parameters can provide temporary protection. Additionally, database permissions should be minimized to restrict the plugin’s access to only necessary data, limiting potential exposure. Regularly monitoring logs for suspicious SQL query patterns or unusual database access can help detect exploitation attempts. Finally, educating site administrators on secure plugin management and timely patching is critical to prevent exploitation of similar vulnerabilities.