CVE-2025-24587 – This SQL injection vulnerability in the Email S... (How to Fix)

📋 TL;DR

This SQL injection vulnerability in the Email Subscription Popup WordPress plugin allows attackers to execute arbitrary SQL commands on the database. It affects all versions up to 1.2.23, potentially compromising websites using this plugin.

💻 Affected Systems

Products:

I Thirteen Web Solution Email Subscription Popup WordPress Plugin

Versions: n/a through 1.2.23

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable plugin versions are affected

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, or website defacement

🟠

Likely Case

Data extraction from the WordPress database including user credentials and sensitive information

🟢

If Mitigated

Limited impact with proper input validation and database permissions

🌐 Internet-Facing: HIGH - WordPress plugins are typically internet-facing and accessible to attackers

🏢 Internal Only: LOW - This is a web application vulnerability requiring external access

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Blind SQL injection requires specialized techniques but is well-documented

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.24 or later

Vendor Advisory: https://patchstack.com/database/wordpress/plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-23-sql-injection-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Email Subscription Popup'
4. Click 'Update Now' if available
5. If no update available, deactivate and remove the plugin

🔧 Temporary Workarounds

Input Validation WAF Rule

all

Implement web application firewall rules to block SQL injection patterns

🧯 If You Can't Patch

Deactivate and remove the Email Subscription Popup plugin immediately
Implement strict input validation and parameterized queries in custom code

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for Email Subscription Popup version

Check Version:

wp plugin list --name='email-subscription-popup' --field=version

Verify Fix Applied:

Verify plugin version is 1.2.24 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual SQL error messages in WordPress debug logs
Multiple failed subscription attempts with SQL syntax

Network Indicators:

HTTP requests with SQL keywords in parameters
Unusual database connection patterns

SIEM Query:

source="wordpress.log" AND ("SQL syntax" OR "database error" OR "wp_email_subscription")

📊 Metadata

CVE ID: CVE-2025-24587

CVSS v3 Score: 7.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

CWE: CWE-89

EPSS Score: 14.68% exploit probability (94.3th percentile)

Published: January 24, 2025

Last Updated: January 24, 2025

🔗 References

https://patchstack.com/database/wordpress/plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-23-sql-injection-vulnerability?_s_id=cve

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-24587, you might also want to check these: