CVE-2025-13652: 
WordPress vulnerability analysis and mitigation

CVE-2025-13652 is a SQL Injection vulnerability in the CBX Bookmark & Favorite plugin for WordPress, affecting all versions up to and including 2.0.4. The flaw exists in the orderby parameter due to insufficient escaping of user-supplied input and lack of proper SQL query preparation, allowing authenticated attackers with Subscriber-level access or above to extract sensitive data from the database. It was disclosed on January 5–6, 2026, with Wordfence as the CNA. The CVSS v3.1 base score is 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising from the plugin's failure to properly escape or sanitize the orderby parameter before incorporating it into SQL queries. An authenticated attacker with at least Subscriber-level WordPress access can manipulate this parameter to append additional SQL statements to existing queries — a classic SQL injection pattern. No complex preconditions are required beyond having a valid low-privilege account on the target WordPress site. A patch was committed to the WordPress plugin repository (changeset 3413499), and a Nuclei detection template was added to ProjectDiscovery's template library (Wordfence, Plugin Changeset, Nuclei Templates).

Successful exploitation allows an authenticated attacker to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, session tokens, and any other data stored in the database. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. While lateral movement is not directly enabled, extracted credentials could facilitate privilege escalation or account takeover on the WordPress site or connected systems (Wordfence).

The EPSS score is approximately 0.026% (0.000260), indicating a low but non-zero probability of exploitation in the wild. A Nuclei detection template was added to ProjectDiscovery's nuclei-templates repository in April 2026, enabling automated scanning for this vulnerability (Nuclei Templates). There is no current evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low privilege requirement (Subscriber-level) lowers the exploitation barrier on sites with open user registration.

1. Reconnaissance: Identify WordPress sites running the CBX Bookmark & Favorite plugin version ≤ 2.0.4 using tools like WPScan, Shodan, or automated Nuclei scans with the available template.
2. Obtain low-privilege access: Register or obtain a Subscriber-level (or higher) account on the target WordPress site, which may be possible if user registration is open.
3. Identify the vulnerable endpoint: Locate the plugin's bookmark/favorite listing functionality that accepts the orderby parameter in its HTTP requests.
4. Craft the SQL injection payload: Manipulate the orderby parameter with a SQL injection payload (e.g., appending UNION SELECT or time-based blind injection statements) to extract data from the database.
5. Extract sensitive data: Use the injected query to retrieve WordPress user table data (e.g., wp_users), including usernames, hashed passwords, and email addresses.
6. Post-exploitation: Crack extracted password hashes offline or use extracted session tokens to escalate privileges or pivot to administrative access (Wordfence, Nuclei Templates).

• Network: Unusual HTTP requests to WordPress endpoints associated with the CBX Bookmark & Favorite plugin containing SQL keywords (UNION, SELECT, FROM, WHERE, SLEEP, BENCHMARK) in the orderby parameter; repeated requests with varying orderby values from the same IP.
• Logs: WordPress or web server access logs showing requests with encoded or obfuscated SQL syntax in query parameters; anomalous database query errors in WordPress debug logs related to the plugin's queries.
• Database: Unexpected or high-volume database queries originating from the plugin's context; queries accessing wp_users, wp_usermeta, or other sensitive tables outside normal plugin operation.
• Process: Unusual database load spikes correlating with authenticated low-privilege user sessions interacting with bookmark/favorite plugin endpoints.

Users should update the CBX Bookmark & Favorite plugin to a version beyond 2.0.4, as the fix was committed in plugin changeset 3413499 on the WordPress plugin repository (Plugin Changeset). If an immediate update is not possible, site administrators should disable the plugin until a patched version is applied. Additionally, restricting user registration to prevent untrusted Subscriber-level accounts and deploying a Web Application Firewall (WAF) — such as Wordfence — can help detect and block SQL injection attempts in the interim (Wordfence).

Wordfence included CVE-2025-13652 in its weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of a broader set of plugin vulnerabilities discovered that week (Wordfence Blog). ProjectDiscovery added a Nuclei detection template for this CVE in April 2026, reflecting community interest in automated detection. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.