CVE-2025-10726: 
WordPress vulnerability analysis and mitigation

CVE-2025-10726 is a critical SQL Injection vulnerability in the WPRecovery plugin for WordPress, affecting all versions up to and including 2.0. The flaw exists in the data[id] parameter, which lacks proper input sanitization and SQL query preparation, enabling unauthenticated attackers to inject arbitrary SQL and also delete files on the server via PHP's unlink() function. It was disclosed on October 3, 2025, by Wordfence. The CVSS v3.1 base score is 9.1 (Critical) (Wordfence, Feedly).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from two compounding flaws in the WPRecovery plugin: insufficient escaping of the user-supplied data[id] parameter and the absence of prepared statements in the SQL query construction (Wordfence). The vulnerable code is located in delete_backup.php (line 5) and index.php (line 166) of the plugin, both accessible via the WordPress SVN repository (Wordfence). Critically, the SQL query result is passed directly to PHP's unlink() function, meaning an attacker can inject a file path through the SQL query to trigger arbitrary file deletion on the server — no authentication is required to exploit either attack vector.

Successful exploitation allows unauthenticated remote attackers to extract sensitive data from the WordPress database (e.g., credentials, user data, configuration secrets) and to delete arbitrary files on the server by manipulating the SQL result passed to unlink(). Deletion of critical files such as WordPress core files, configuration files (wp-config.php), or plugin files could render the site inoperable, resulting in high availability and integrity impact. While the CVSS vector indicates no direct confidentiality impact (C:N), database enumeration via SQL injection can still expose sensitive information indirectly (Feedly, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable if a PoC becomes available. The EPSS score is approximately 0.09%, indicating a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Identify WordPress sites running the WPRecovery plugin (version ≤ 2.0) using tools like WPScan, Shodan, or by checking /wp-content/plugins/wprecovery/ for plugin presence.
2. Locate the vulnerable endpoint: Target the delete_backup.php endpoint within the WPRecovery plugin, which processes the data[id] POST parameter without sanitization.
3. Craft a SQL injection payload: Construct a malicious POST request with a crafted data[id] value that appends additional SQL statements (e.g., UNION SELECT or stacked queries) to extract data from the WordPress database, such as the wp_users table containing hashed credentials.
4. File deletion via unlink(): Inject a file path (e.g., the path to wp-config.php) through the SQL query result so that when the result is passed to PHP's unlink() function, the target file is deleted from the server.
5. Achieve objective: Use extracted credentials for account takeover, or leverage file deletion to disrupt site availability or remove security controls (Wordfence, ZeroPath).

• Network: Unusual POST requests to /wp-content/plugins/wprecovery/delete_backup.php containing SQL metacharacters (e.g., ', --, UNION, SELECT) in the data[id] parameter; high volume of requests to this endpoint from a single IP.
• Logs: WordPress or web server access logs showing POST requests to delete_backup.php with anomalous or encoded data[id] values; PHP error logs referencing unlink() failures on unexpected file paths.
• File System: Unexpected deletion of critical WordPress files such as wp-config.php, core plugin files, or theme files; missing files in the WordPress root or plugin directories.
• Database: Unexpected or unauthorized queries in the MySQL slow query log or general query log involving UNION SELECT or stacked queries against WordPress tables (e.g., wp_users, wp_options).

The primary remediation is to update the WPRecovery plugin to a version beyond 2.0 that addresses the SQL injection vulnerability by implementing parameterized queries and proper input sanitization (Wordfence). If no patched version is yet available, site administrators should immediately deactivate and remove the WPRecovery plugin. Additionally, applying a Web Application Firewall (WAF) rule to block SQL injection patterns targeting the delete_backup.php endpoint can serve as a temporary mitigation. Restricting file system write permissions and enforcing the principle of least privilege for the web server user can limit the impact of the unlink() abuse vector.

Wordfence, which discovered and reported the vulnerability, published it in their weekly WordPress vulnerability report for the period of September 29 – October 5, 2025, highlighting it among notable new disclosures (Wordfence Blog). ZeroPath published a dedicated technical blog post analyzing the SQL injection and arbitrary file deletion chain (ZeroPath). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.