CVE-2025-13192: 
WordPress vulnerability analysis and mitigation

CVE-2025-13192 is a SQL Injection vulnerability in the "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers" plugin for WordPress. It affects all versions up to and including 2.2.0, allowing unauthenticated attackers to append malicious SQL queries via multiple REST API endpoints due to insufficient input escaping and improper query preparation. The vulnerability was published on February 5, 2026, and carries a CVSS v3.1 base score of 8.2 (High) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from insufficient escaping of user-supplied parameters and a lack of prepared statements across multiple REST API endpoints in the plugin (Red Hat CVE). Because the vulnerable endpoints are accessible without authentication, an attacker can craft HTTP requests containing malicious SQL fragments that are appended to existing queries, enabling blind or error-based SQL injection techniques (CAPEC-7, CAPEC-66). No special preconditions — such as an active user session or specific site configuration — are required for exploitation against unauthenticated attack surfaces; Administrator-level injection vectors were separately addressed in version 2.2.3.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, personal data, and any other confidential content stored by the site (Red Hat CVE). The CVSS scoring reflects high confidentiality impact and low integrity impact, with no direct availability impact. Extracted credentials could facilitate account takeover, privilege escalation, or lateral movement within the WordPress environment.

As of the time of reporting, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Red Hat CVE). The vulnerability has an EPSS score of approximately 0.104%, indicating a low but non-negligible probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was detected by Qualys (detection ID 530917) and included in CISA's weekly vulnerability bulletin for the week of February 2, 2026 (CISA Bulletin).

1. Reconnaissance: Identify WordPress sites running the "Popup builder with Gamification" plugin at version 2.2.0 or earlier using tools like WPScan, Shodan, or by inspecting publicly accessible plugin metadata (e.g., /wp-content/plugins/ directory listings or readme.txt files).
2. Identify vulnerable REST API endpoints: Enumerate the plugin's REST API endpoints registered under the WordPress REST API (e.g., /wp-json/<plugin-namespace>/v1/<endpoint>) by reviewing plugin source code or API discovery tools.
3. Craft malicious SQL payload: Construct an HTTP request (GET or POST) to a vulnerable endpoint, injecting SQL syntax into a user-supplied parameter (e.g., appending ' OR 1=1-- or time-based blind injection payloads like ' AND SLEEP(5)--) that is insufficiently escaped before being incorporated into a database query.
4. Extract database contents: Use automated tools such as sqlmap targeting the identified endpoint and parameter to enumerate databases, tables, and extract sensitive data such as WordPress user credentials (wp_users table) and site options.
5. Leverage extracted data: Use recovered credentials (after cracking hashed passwords) to authenticate to the WordPress admin panel or other services, enabling further compromise of the site.

• Network: Unusual or repeated HTTP requests to WordPress REST API endpoints associated with the Popup builder plugin (e.g., /wp-json/<plugin-namespace>/v1/*) containing SQL metacharacters such as single quotes ('), UNION, SELECT, SLEEP, or -- in query parameters or request bodies.
• Logs: WordPress or web server access logs showing high volumes of requests to plugin REST API endpoints from a single IP or user agent; HTTP 200 or 500 responses to requests with anomalous parameter values indicative of SQL injection probing.
• Database: Unexpected or unauthorized database queries logged in MySQL slow query logs or general query logs, particularly those involving UNION SELECT, information_schema, or SLEEP() functions.
• File System: No direct file system artifacts expected for read-only SQL injection; however, if exploitation escalates to write operations, watch for new or modified PHP files in the WordPress installation directory.

The vulnerability was partially patched in version 2.2.1 (addressing unauthenticated attack vectors) and fully patched in version 2.2.3 (addressing Administrator-level vectors as well); upgrading to version 2.2.3 or later is the recommended remediation (Red Hat CVE, Wordfence). If an immediate upgrade is not possible, consider temporarily disabling the plugin or deploying a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts targeting the plugin's REST API endpoints. Monitor database access logs for anomalous query patterns as an interim detection measure.

Wordfence included CVE-2025-13192 in its weekly WordPress vulnerability report for February 2–8, 2026, highlighting it as a notable unauthenticated SQL injection risk (Wordfence). The vulnerability was also referenced in CISA's weekly vulnerability bulletin and picked up by security aggregators including Qualys, Vulners, and VulDB shortly after publication. Social media mentions were observed on Mastodon and Bluesky via TheHackerWire, indicating moderate community awareness.