CVE-2025-68857: 
WordPress vulnerability analysis and mitigation

CVE-2025-68857 is a Blind SQL Injection vulnerability in the Paid Downloads WordPress plugin developed by ichurakov. It affects all versions through 3.15 and allows unauthenticated remote attackers to extract sensitive data from the underlying database. The vulnerability was reported by researcher 0xVenus on November 7, 2025, and publicly disclosed by Patchstack on January 21–22, 2026. It carries a CVSS v3.1 base score of 9.3 (Critical), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is not properly sanitized before being incorporated into SQL queries within the Paid Downloads plugin. The attack vector is network-based, requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any remote attacker. The specific injection point has not been publicly detailed in available sources, but the blind SQL injection technique (CAPEC-7) implies that data is extracted through boolean- or time-based inference rather than direct error output. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an unauthenticated attacker to read sensitive data from the WordPress database, including user credentials (hashed passwords), email addresses, plugin configuration data, and any other information stored in the database. The CVSS scope is marked as "Changed," indicating the impact extends beyond the plugin itself to the broader database and potentially the WordPress installation. Availability may also be marginally degraded (Low availability impact), and while integrity is not directly affected, stolen credentials could enable further account takeover or lateral movement within the WordPress environment (Patchstack, NVD).

As of the time of disclosure, no public proof-of-concept exploit code has been identified and no active in-the-wild exploitation has been confirmed. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this severity class (CVSS 9.3, unauthenticated) are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Paid Downloads plugin (versions ≤ 3.15) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt or plugin metadata files.
2. Identify injection point: Probe the plugin's publicly accessible endpoints (e.g., download request handlers or form parameters) for SQL injection by submitting crafted payloads and observing response differences.
3. Confirm blind injection: Use boolean-based payloads (e.g., appending AND 1=1 vs. AND 1=2) to confirm the presence of a blind SQL injection point based on differing application responses.
4. Extract data via blind inference: Use automated tools such as sqlmap with blind injection techniques to enumerate database tables, extract WordPress user table (wp_users) contents including usernames and password hashes, and retrieve other sensitive data.
5. Post-exploitation: Crack extracted password hashes offline or use stolen credentials to log into the WordPress admin panel, potentially enabling full site compromise (Patchstack).

• Network: Unusual or repeated HTTP requests to Paid Downloads plugin endpoints containing SQL metacharacters (e.g., ', --, AND, OR, SLEEP, BENCHMARK) in query parameters or POST body fields.
• Logs: WordPress or web server access logs showing high volumes of requests to plugin-specific URLs with varying parameter values consistent with blind SQL injection enumeration; time-delayed responses (indicative of time-based blind SQLi using SLEEP() or BENCHMARK()).
• Database: Unexpected or anomalous database query patterns in MySQL slow query logs, particularly queries with unusual conditional logic or time-delay functions originating from the web application user.
• Process: Elevated database CPU usage or query latency without corresponding legitimate traffic spikes, which may indicate time-based blind SQL injection in progress.

As of the disclosure date, no official patch has been released for the Paid Downloads plugin beyond version 3.15. Administrators should monitor the WordPress plugin repository for an updated version and upgrade immediately when one becomes available. In the interim, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts. Additional workarounds include deploying a Web Application Firewall (WAF) with SQL injection detection rules, applying the principle of least privilege to the WordPress database user account, and temporarily deactivating the plugin if it is not critical to operations (Patchstack).

Wordfence included CVE-2025-68857 in its weekly WordPress vulnerability report covering January 19–25, 2026, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week. Patchstack, which discovered and disclosed the vulnerability through researcher 0xVenus, characterized it as high priority and warned that vulnerabilities of this CVSS class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic (Wordfence, Patchstack).