PT-2025-40475 · WordPress · Wprecovery

Dj + 1 · Published 2025-10-03 · Updated 2025-10-08 · CVE-2025-10726

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPRecovery versions prior to 2.1

Description The WPRecovery plugin for WordPress is affected by a SQL Injection issue due to insufficient input validation and preparation of SQL queries. Specifically, the data[id] parameter is vulnerable. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. The result of this injection is then passed to PHP’s unlink() function, enabling attackers to delete arbitrary files on the server by injecting file paths through the SQL query.

Recommendations Update WPRecovery to version 2.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10726

Affected Products

Wprecovery

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-10726 · Security Note
• https://twitter.com/CveFindCom/status/1974077934957633563 · Twitter Post
• https://twitter.com/0dayPublishing/status/1974076746224787653 · Twitter Post
• https://plugins.svn.wordpress.org/wprecovery/trunk/delete_backup.php · Note
• https://plugins.svn.wordpress.org/wprecovery/trunk/index.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/delete_backup.php#L5 · Note
• https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/index.php#L166 · Note
• https://twitter.com/VulmonFeeds/status/1974190461007835488 · Twitter Post
• https://twitter.com/cracbot/status/1975878893740372235 · Twitter Post