CVE-2025-14314: 
WordPress vulnerability analysis and mitigation

CVE-2025-14314 is a Blind SQL Injection vulnerability in the Roxnor PopupKit WordPress plugin (slug: popup-builder-block), classified under CWE-89. It affects all versions of PopupKit up to and including 2.1.5, with version 2.2.0 serving as the patched release. The vulnerability was reported by researcher 0xd4rk5id3 on October 22, 2025, published by Patchstack on November 21, 2025, and assigned a CVE on December 18, 2025. It carries a CVSS v3.1 base score of 8.5 (High) (Patchstack).

The vulnerability is rooted in improper neutralization of special elements in SQL commands (CWE-89), allowing an authenticated attacker with low privileges (Subscriber-level) to inject malicious SQL into database queries executed by the PopupKit plugin. The attack is network-based, requires no user interaction, and operates with a changed scope — meaning the impact extends beyond the plugin itself to the underlying WordPress database. The blind nature of the injection means the attacker infers database contents through boolean-based or time-based response differences rather than direct output. No public proof-of-concept code has been disclosed (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to extract sensitive data from the WordPress database, including user credentials, email addresses, configuration data, and any content stored by the site. Confidentiality impact is rated High, with a Low availability impact also noted. While integrity impact is classified as None in the CVSS score, blind SQL injection techniques can in some configurations be leveraged to modify database contents or escalate privileges, potentially enabling full site compromise (Patchstack).

There is no public proof-of-concept exploit and no confirmed in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.021% (0.000210), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates this as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the PopupKit plugin (version ≤ 2.1.5) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/popup-builder-block/readme.txt.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site, as the vulnerability requires at minimum this privilege level.
3. Identify the vulnerable parameter: Interact with PopupKit plugin functionality (e.g., popup listing or management endpoints) and intercept HTTP requests using a proxy such as Burp Suite to identify parameters passed to SQL queries.
4. Inject blind SQL payload: Craft boolean-based or time-based blind SQL injection payloads (e.g., ' AND SLEEP(5)-- or ' AND 1=1--) into the vulnerable parameter and observe response timing or behavioral differences to confirm injection.
5. Extract database contents: Use automated tools such as sqlmap with the identified injection point to enumerate databases, tables, and extract sensitive data such as WordPress user hashes, email addresses, and configuration values.
6. Escalate if possible: Use extracted administrator password hashes for offline cracking or session token theft to escalate to full administrative access (Patchstack).

• Network: Unusual or repeated HTTP requests to PopupKit plugin endpoints from a single authenticated low-privilege user; requests containing SQL metacharacters (', --, SLEEP, WAITFOR, AND 1=) in query parameters or POST bodies.
• Logs: WordPress access logs showing repeated requests to plugin-related REST API or admin-ajax endpoints with anomalous parameter values; MySQL slow query logs showing unexpected SLEEP() or heavy boolean queries originating from the WordPress database user.
• Database: Unexpected queries in MySQL general query log referencing PopupKit tables with injected SQL syntax; unusual enumeration patterns across information_schema tables.
• Application: Sudden appearance of new administrator accounts or modified user roles in the WordPress database not corresponding to legitimate admin actions.

The primary remediation is to update the PopupKit plugin to version 2.2.0 or later, which contains the fix for this vulnerability (Patchstack). Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated. As interim measures, site administrators should restrict Subscriber-level registration if not required, deploy a Web Application Firewall (WAF) with SQL injection detection rules, enforce least-privilege database access for the WordPress database user, and monitor database and access logs for suspicious query patterns.