CVE-2026-25378: 
WordPress vulnerability analysis and mitigation

CVE-2026-25378 is a Blind SQL Injection vulnerability in the Nelio AB Testing WordPress plugin by Nelio Software, classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). It affects all versions of the plugin up to and including 8.2.4. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 7.6 (High) (Feedly).

The vulnerability stems from insufficient sanitization of user-supplied input that is incorporated into SQL queries, allowing an attacker to inject malicious SQL syntax (CWE-89). The attack vector is network-based with low attack complexity, but requires high privileges (e.g., administrator-level access to the WordPress backend) to exploit. The scope is changed, meaning the impact extends beyond the vulnerable component itself. No public proof-of-concept code or detailed technical write-up has been identified at this time (Feedly).

Successful exploitation of this blind SQL injection vulnerability can result in high confidentiality impact, enabling an authenticated attacker to extract sensitive data from the WordPress database — including user credentials, personal information, and site configuration. Integrity impact is rated none, and availability impact is low. The changed scope indicates potential for data exposure beyond the plugin's own database tables (Feedly).

The vulnerability requires high privileges to exploit, limiting the attack surface to authenticated users with administrative access. The EPSS score is approximately 0.021%, indicating a low probability of exploitation in the wild in the near term. No evidence of active in-the-wild exploitation, exploit kits, or threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Users should update the Nelio AB Testing WordPress plugin to a version beyond 8.2.4 as soon as a patched release is made available by Nelio Software. In the interim, site administrators should restrict access to the WordPress admin panel using IP allowlisting or two-factor authentication to reduce the risk of exploitation by compromised high-privilege accounts. Monitoring database query logs for anomalous or time-delayed SQL patterns may help detect exploitation attempts (Feedly).

The vulnerability was noted by The Hacker Wire and tracked by VulDB and the GCVE database shortly after disclosure. Social media activity was minimal, with a Bluesky post from The Hacker Wire referencing the CVE. No significant vendor statements or notable researcher commentary beyond routine tracking have been identified (Feedly).