CVE-2025-67518: 
WordPress vulnerability analysis and mitigation

CVE-2025-67518 is a Blind SQL Injection vulnerability in the LambertGroup Accordion Slider PRO WordPress plugin, affecting all versions up to and including 1.2. The flaw allows unauthenticated remote attackers to inject malicious SQL commands into the application's database layer. It was reported by researcher Phat RiO on November 14, 2025, and publicly disclosed on December 9–14, 2025. The NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while Patchstack rates it 8.5 with a low exploitation priority (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), manifesting as a Blind SQL Injection in the Accordion Slider PRO plugin's database query handling. Exploitation requires Contributor or Developer-level privileges according to Patchstack's assessment, which partially mitigates the unauthenticated attack vector indicated by the NVD CVSS score. The attack is network-based, requires low complexity, and no user interaction, making it straightforward to exploit once access conditions are met. No public proof-of-concept code has been identified (Patchstack).

Successful exploitation could allow an attacker to extract sensitive data from the WordPress database (including credentials, user data, and configuration), modify or delete database records, and potentially compromise the entire WordPress site's data integrity and confidentiality. In a worst-case scenario, database-level access could be leveraged to escalate privileges within the WordPress application or execute administrative operations. The vulnerability affects all sites running Accordion Slider PRO version 1.2 or earlier (Patchstack).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. CVE-2025-67518 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the exploitation priority as low, noting the vulnerability is unlikely to be actively exploited despite its high CVSS score (Patchstack).

The patched version is Accordion Slider PRO 1.3, which resolves the SQL injection vulnerability. Site administrators should update the plugin to version 1.3 or later immediately. If an immediate update is not possible, recommended interim mitigations include temporarily disabling the plugin, deploying Web Application Firewall (WAF) rules to block SQL injection patterns, restricting access to the WordPress admin interface, and monitoring database activity for anomalies. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for December 8–14, 2025, providing broader community visibility. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified (Wordfence Blog).