CVE-2025-49931: 
WordPress vulnerability analysis and mitigation

CVE-2025-49931 is a Blind SQL Injection vulnerability in the Crocoblock JetSearch WordPress plugin, classified under CWE-89. It affects all versions of JetSearch up to and including 3.5.10, and was reported by researcher "stealthcopter" on June 17, 2025, with public disclosure on October 22, 2025. The vulnerability was assigned a CVSS v3.1 base score of 9.3 (Critical) by Patchstack, reflecting its unauthenticated, network-exploitable nature (Patchstack).

The vulnerability is rooted in improper neutralization of special elements in SQL commands (CWE-89), allowing an attacker to inject malicious SQL syntax into database queries processed by the JetSearch plugin. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity, making it trivially exploitable by remote unauthenticated attackers. The injection is of the "blind" type, meaning the attacker infers database contents through conditional responses or time-based techniques rather than direct output. The vulnerability was discovered and reported through Patchstack's Vulnerability Disclosure Program (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to interact directly with the WordPress site's underlying database, with a high confidentiality impact and low availability impact across a changed scope. Attackers can extract sensitive data including user credentials, personal information, and site configuration, potentially enabling account takeover or further compromise of the WordPress environment. The changed scope indicates that the impact extends beyond the plugin itself to the broader WordPress installation and its database (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.021%, indicating a currently low probability of exploitation in the near term. However, Patchstack has flagged this vulnerability as "highly dangerous and expected to become exploited," noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack). There is no current CISA KEV catalog listing for this CVE.

1. Reconnaissance: Identify WordPress sites running the JetSearch plugin (version ≤ 3.5.10) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/jet-search/readme.txt.
2. Identify injectable parameter: Interact with the JetSearch search functionality on the target site to identify the HTTP request parameters processed by the plugin that are passed to SQL queries.
3. Craft blind SQL injection payload: Construct a boolean-based or time-based blind SQL injection payload (e.g., using AND SLEEP(5) or conditional expressions) and inject it into the vulnerable parameter in the search request.
4. Extract database contents: Use automated tools such as sqlmap to systematically enumerate the database schema, extract table contents (e.g., wp_users), and retrieve sensitive data such as usernames and hashed passwords.
5. Leverage extracted credentials: Crack retrieved password hashes offline and use valid credentials to authenticate to the WordPress admin panel or other services, enabling further compromise (Patchstack).

• Network: Unusual or high-volume HTTP requests to WordPress search endpoints (e.g., /?s= or AJAX endpoints used by JetSearch) containing SQL syntax fragments such as SLEEP(), AND 1=1, OR 1=1, UNION SELECT, or encoded equivalents.
• Logs: WordPress or web server access logs showing repeated requests to JetSearch-related endpoints with anomalous query strings; time-delayed responses (indicative of time-based blind SQLi) visible in server response time logs.
• Database: Unexpected database queries logged in MySQL slow query logs containing conditional SQL logic or sleep functions originating from the web application user.

The patched version of JetSearch is 3.5.10.1, and all users should update immediately. Patchstack has also issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until the plugin is updated. If an immediate update is not possible, site administrators should consider temporarily disabling the JetSearch plugin or restricting access to the WordPress site until the patch can be applied (Patchstack).