CVE-2025-11501: 
WordPress vulnerability analysis and mitigation

The Dynamically Display Posts plugin for WordPress contains an SQL Injection vulnerability (CVE-2025-11501) in all versions up to and including 1.1. The vulnerability exists due to insufficient escaping of the 'tax_query' parameter and lack of proper SQL query preparation (AttackerKB).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (High), with an Impact Score of 3.6 and Exploitability Score of 3.9. The attack vector is Network-based (AV:N), requires Low attack complexity (AC:L), needs No privileges (PR:N), and requires No user interaction (UI:N). The scope is Unchanged (S:U), with High impact on Confidentiality (C:H) but No impact on Integrity (I:N) and Availability (A:N) (AttackerKB).

The vulnerability allows unauthenticated attackers to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the WordPress database (AttackerKB).

The vulnerability is exploitable by unauthenticated attackers through the manipulation of the 'tax_query' parameter. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit (AttackerKB).