CVE-2025-1768 is a blind SQL Injection vulnerability categorized under CWE-89, found in the SEO Plugin by Squirrly SEO for WordPress, affecting all versions up to and including 12.4.05. The vulnerability arises from insufficient escaping and lack of proper query preparation on the 'search' parameter, which is user-supplied. Authenticated attackers with as low as Subscriber-level privileges can exploit this flaw by injecting malicious SQL code appended to existing queries. This allows them to extract sensitive information from the backend database, such as user credentials, configuration data, or other confidential content stored within the WordPress database. The vulnerability does not require user interaction and can be exploited remotely over the network. The CVSS v3.1 score is 6.5, reflecting medium severity with high confidentiality impact but no integrity or availability impact. No patches or official fixes are currently linked, and no known exploits have been reported in the wild. The vulnerability highlights the risk of improper input validation and the importance of using parameterized queries or prepared statements in WordPress plugin development.

The primary impact of this vulnerability is unauthorized disclosure of sensitive information stored in the WordPress database. Attackers with minimal privileges can escalate their access by extracting data that could lead to further attacks, such as credential theft or site takeover. Although the vulnerability does not directly affect data integrity or availability, the exposure of confidential data can compromise user privacy, intellectual property, and organizational security. For organizations relying on the Squirrly SEO plugin, this could lead to reputational damage, regulatory non-compliance (especially under data protection laws like GDPR), and potential financial losses. The ease of exploitation by low-privileged authenticated users increases the risk, especially in environments where subscriber accounts are easily created or compromised.

Organizations should immediately audit their WordPress installations to identify the presence of the Squirrly SEO plugin and its version. Until an official patch is released, administrators should consider disabling the plugin or restricting access to authenticated users with Subscriber-level privileges. Implementing strict user role management and monitoring for unusual database query patterns can help detect exploitation attempts. Employing Web Application Firewalls (WAFs) with custom rules to detect and block SQL injection patterns targeting the 'search' parameter is recommended. Developers should update the plugin code to use parameterized queries or prepared statements to properly sanitize user input. Regular backups and database encryption can reduce the impact of data exposure. Finally, organizations should stay alert for official patches or updates from the vendor and apply them promptly once available.