CVE-2025-69310: 
WordPress vulnerability analysis and mitigation

CVE-2025-69310 is a Blind SQL Injection vulnerability in the TeconceTheme Woodly Core WordPress plugin (woodly-core), affecting all versions through 1.4. It was reported by researcher Phat RiO on November 19, 2025, and published by Patchstack on January 28, 2026, with NVD publication on February 20, 2026. The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical) (Patchstack, Feedly).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), allowing unauthenticated remote attackers to perform Blind SQL Injection against the WordPress database. No authentication or user interaction is required, and the attack is conducted over the network with low complexity. The scope is marked as CHANGED, indicating that the impact can extend beyond the vulnerable plugin component itself to other database-backed resources. No public proof-of-concept or detailed technical write-up has been published as of the latest available data (Patchstack, Feedly).

Successful exploitation allows unauthenticated attackers to extract sensitive data from the WordPress database by observing application behavior or response timing (blind injection technique), resulting in high confidentiality impact. The CHANGED scope indicates potential for impact beyond the plugin itself, possibly affecting other components sharing the database. A low availability impact is also noted, suggesting limited potential for service disruption (Patchstack, Feedly).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been observed as of the latest available data. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. However, Patchstack classifies this as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. No CISA KEV catalog listing has been identified (Patchstack, Feedly).

No official patch from TeconceTheme is available as of the latest reporting; the vulnerable version remains 1.4 and below. Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for users of their service. Recommended actions include:

• Immediate: Audit all WordPress installations using Woodly Core ≤ 1.4 and assess exposure.
• Short-term: Deploy a Web Application Firewall (WAF) with SQL injection detection rules (e.g., Patchstack, Wordfence).
• Database hardening: Apply the principle of least privilege to the database account used by WordPress to limit damage from successful injection.
• Monitoring: Review database query logs for anomalous or time-delayed queries indicative of blind SQL injection.
• Long-term: Upgrade to a patched version once released by TeconceTheme, or consider replacing the plugin if no patch is forthcoming (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher Phat RiO, flagged it as high priority and noted its potential for use in mass-exploit campaigns against WordPress sites. Wordfence also referenced the vulnerability in their weekly WordPress vulnerability intelligence report for the period of January 26 – February 1, 2026 (Patchstack, Wordfence).