CVE-2025-67516: 
WordPress vulnerability analysis and mitigation

CVE-2025-67516 is a Blind SQL Injection vulnerability in the Agile Logix Store Locator WordPress plugin (agile-store-locator), classified under CWE-89. It affects all versions of the plugin up to and including 1.6.2, and was reported by researcher Jarno Vos (jrn5151) on November 14, 2025, with public disclosure on December 9–14, 2025. The vulnerability carries a CVSS v3.1 base score of 8.5 (High) (Patchstack).

The vulnerability is rooted in improper neutralization of special elements in SQL commands (CWE-89), allowing an authenticated attacker with low privileges (Contributor/Developer level) to inject malicious SQL syntax into plugin-handled inputs. The attack vector is network-based, requires no user interaction, and operates with a changed scope — meaning the impact can extend beyond the plugin's immediate context to the underlying database. The specific injection point is within the plugin's store locator functionality, and the technique used is Blind SQL Injection (CAPEC-7), where the attacker infers database contents through conditional responses rather than direct output (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to extract sensitive data from the WordPress database, including user credentials, personal information, and site configuration data (high confidentiality impact). Availability is marginally affected (low impact), while integrity is not directly impacted. Because the scope is marked as changed, the vulnerability could potentially affect database resources beyond the plugin's own tables, increasing the risk of broader data exposure across the WordPress installation (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as Low, noting it is unlikely to be exploited despite the high CVSS score (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Store Locator WordPress plugin (agile-store-locator) version 1.6.2 or earlier using tools like WPScan or Shodan, or by checking the plugin's readme.txt file exposed at /wp-content/plugins/agile-store-locator/readme.txt.
2. Authenticate: Obtain or register a low-privileged WordPress account (Contributor or Developer role) on the target site.
3. Identify injection point: Locate the plugin's store locator input fields or API endpoints that pass user-supplied parameters to database queries without proper sanitization.
4. Craft blind SQL injection payload: Inject time-based or boolean-based blind SQL payloads (e.g., using SLEEP() or conditional AND 1=1/AND 1=2 logic) into the vulnerable parameter to infer database structure and content.
5. Extract data: Use automated tools such as sqlmap with session cookies to systematically enumerate database tables, columns, and extract sensitive data such as WordPress user hashes or site configuration (Patchstack).

• Network: Unusual or repeated HTTP requests to Store Locator plugin endpoints containing SQL metacharacters (e.g., single quotes, SLEEP, AND 1=, UNION SELECT) in query parameters.
• Logs: WordPress or web server access logs showing abnormal response time patterns (indicative of time-based blind SQLi) or high volumes of requests to plugin-specific endpoints from a single authenticated session.
• Database: Unexpected or slow-running queries in MySQL slow query logs originating from the WordPress database user, particularly involving SLEEP() or complex conditional expressions.
• File System: No direct file system artifacts expected for SQL injection exploitation, but monitor for new admin accounts or modified WordPress options table entries that may indicate post-exploitation activity.

The vendor has released version 1.6.3 of the Store Locator WordPress plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.6.3 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. As interim measures, restrict plugin functionality to trusted users only, implement a web application firewall (WAF) with SQL injection rules, and monitor database activity for anomalous queries. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the week of December 8–14, 2025, as part of routine security intelligence reporting. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database listings.