CVE-2025-1323
📋 TL;DR
This SQL injection vulnerability in the WP-Recall WordPress plugin allows unauthenticated attackers to inject malicious SQL queries via the 'databeat' parameter. Attackers can extract sensitive information from the database, including user credentials and other confidential data. All WordPress sites using WP-Recall plugin versions up to 16.26.10 are affected.
💻 Affected Systems
- WP-Recall - Registration, Profile, Commerce & More WordPress plugin
📦 What is this software?
Wp Recall by Plechevandrey
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential site takeover.
Likely Case
Extraction of sensitive user data including usernames, emails, and potentially hashed passwords.
If Mitigated
Limited data exposure if database permissions are properly restricted and input validation is implemented elsewhere.
🎯 Exploit Status
Exploitation requires understanding of SQL injection techniques but is accessible to moderately skilled attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 16.26.10
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP-Recall plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin, then install latest version from WordPress repository.
🔧 Temporary Workarounds
Input Validation Web Application Firewall Rule
allBlock requests containing SQL injection patterns in the 'databeat' parameter
Temporary Plugin Deactivation
WordPress CLIDisable WP-Recall plugin until patched version is available
wp plugin deactivate wp-recall
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict database user permissions to read-only for the application account
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → WP-Recall version. If version is 16.26.10 or lower, you are vulnerable.Check Version:
wp plugin list --name=wp-recall --field=versionVerify Fix Applied:
After update, verify WP-Recall plugin version is higher than 16.26.10 in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with 'databeat' parameter containing SQL keywords
- Increased error rates from database
Network Indicators:
- HTTP POST requests to WordPress endpoints with SQL injection patterns in parameters
- Unusual data extraction patterns from database
SIEM Query:
source="web_logs" AND (uri_path="*wp-recall*" OR uri_path="*rcl-chat*") AND (param="databeat" AND value="*UNION*" OR value="*SELECT*" OR value="*INSERT*" OR value="*DELETE*")