CVE-2025-13922
BaseFortify
Publication date: 2025-12-06
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | simple_tags | 3.40.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Contributor-level access and AI metabox permissions to perform time-based blind SQL Injection, potentially extracting sensitive information from the database. This unauthorized data access could lead to breaches of sensitive personal or protected health information, thereby impacting compliance with standards like GDPR and HIPAA that require protection of such data. The risk of data leakage and unauthorized access due to insufficient input sanitization and lack of query parameterization could result in violations of data protection regulations. [4]
Can you explain this vulnerability to me?
This vulnerability is a time-based blind SQL Injection in the Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress. It occurs via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint due to insufficient escaping of user input and lack of SQL query parameterization. Authenticated users with Contributor-level access or higher who have AI metabox permissions can exploit this to append additional SQL queries, potentially extracting sensitive database information or causing performance issues.
How can this vulnerability impact me? :
The vulnerability can allow attackers with certain access to extract sensitive information from the database, degrade system performance, or infer data through time-based techniques. This could lead to unauthorized data disclosure and negatively affect the availability and reliability of the affected WordPress site.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious AJAX POST requests to the AI preview endpoint that include the 'existing_terms_orderby' parameter with unusual or crafted SQL payloads. Since the vulnerability involves time-based blind SQL Injection, detection can involve sending controlled payloads to observe response delays indicating SQL query execution time manipulation. Commands to detect this might include using curl or similar tools to send crafted POST requests with SQL injection payloads in the 'existing_terms_orderby' parameter and measuring response times. For example: curl -X POST -d 'existing_terms_orderby=1 AND IF(SLEEP(5),1,0)-- ' https://yourwordpresssite/wp-admin/admin-ajax.php?action=taxopress_ai_preview. Additionally, monitoring web server logs for repeated or anomalous requests to the AI preview AJAX endpoint from authenticated users with Contributor-level access or higher can help detect exploitation attempts. [4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Simple Tags plugin to version 3.40.2 or later where the vulnerability is patched. If updating is not immediately possible, restrict Contributor-level and above users' access to the AI metabox permissions to limit who can exploit the vulnerability. Additionally, ensure that nonce verification and user capability checks are properly enforced on AJAX endpoints. Monitoring and blocking suspicious AJAX requests targeting the AI preview endpoint can also help reduce risk. Applying web application firewall (WAF) rules to detect and block SQL injection patterns in the 'existing_terms_orderby' parameter is recommended until the plugin is updated. [2, 4]