CVE-2025-60239: 
WordPress vulnerability analysis and mitigation

CVE-2025-60239 is a Blind SQL Injection vulnerability in the CoSchool LMS WordPress plugin developed by Codexpert, Inc. It affects all versions up to and including 1.4.3, allowing low-privileged authenticated attackers to inject malicious SQL commands via network access without user interaction. The vulnerability was reported by researcher Martino Spagnuolo (r3verii) on June 14, 2025, and published by Patchstack on July 14, 2025. It carries a CVSS v3.1 base score of 8.5 (High) (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), enabling Blind SQL Injection attacks. An attacker with at minimum Subscriber-level WordPress privileges can craft malicious SQL payloads that are passed unsanitized into database queries, allowing inference of database contents through boolean- or time-based blind techniques. The attack vector is network-based, requires low privileges, no user interaction, and has a changed scope — indicating the impact extends beyond the vulnerable component itself. No public proof-of-concept code has been disclosed as of the time of reporting (Patchstack).

Successful exploitation allows a low-privileged attacker to extract sensitive database contents, including user credentials, personal data, and application configuration, resulting in high confidentiality impact. The changed scope indicates potential for impact beyond the plugin itself, potentially affecting the broader WordPress installation and underlying database. Availability is also partially impacted (rated Low), and while integrity impact is not scored, database manipulation remains a realistic risk in practice (Patchstack).

No public proof-of-concept exploit has been published, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies this as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the CoSchool LMS plugin version ≤ 1.4.3 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site, as the vulnerability requires at minimum this privilege level.
3. Identify injectable parameter: Interact with CoSchool LMS plugin functionality (e.g., course enrollment, quiz, or user-facing forms) and intercept HTTP requests using a proxy tool such as Burp Suite to identify parameters passed to database queries.
4. Craft blind SQL injection payload: Inject boolean-based or time-based blind SQL payloads (e.g., ' AND SLEEP(5)-- or ' AND 1=1--) into the vulnerable parameter to confirm injection and infer database behavior.
5. Extract data: Use automated tools such as sqlmap with the identified endpoint and session cookie to enumerate databases, tables, and extract sensitive data (e.g., WordPress user hashes, plugin data).
6. Post-exploitation: Use extracted credentials or data to escalate privileges within the WordPress application or pivot to other systems (Patchstack).

• Network: Unusual or repeated HTTP requests to CoSchool LMS plugin endpoints containing SQL metacharacters (e.g., single quotes, SLEEP(), UNION SELECT, AND 1=1) in query parameters or POST body.
• Logs: WordPress or web server access logs showing high volumes of requests to plugin-specific URLs from a single authenticated low-privilege user; database error messages logged in debug.log related to malformed SQL queries.
• Database: Unexpected queries in MySQL slow query logs involving SLEEP() or conditional boolean expressions; anomalous read patterns on sensitive tables (e.g., wp_users).
• Application: Unusual activity from Subscriber-level accounts, such as repeated access to LMS endpoints outside normal usage patterns (Patchstack).

No official patch from the vendor (Codexpert, Inc) was available as of the Patchstack disclosure on July 14, 2025; users should upgrade to any version beyond 1.4.3 if and when released. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts. Additional hardening steps include implementing input validation and parameterized queries at the application level, applying least-privilege principles to database accounts, and monitoring database and application logs for suspicious activity (Patchstack).

The vulnerability was discovered and responsibly disclosed by security researcher Martino Spagnuolo (r3verii) and published through Patchstack's vulnerability disclosure program. Patchstack classified it as high priority, noting that SQL injection vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).