PT-2025-41682 · WordPress · Custom 404 Pro

Jamaal · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-9947

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Custom 404 Pro plugin for WordPress versions prior to 3.13.0

Description The Custom 404 Pro plugin for WordPress is susceptible to time-based SQL Injection through the path parameter. This is due to inadequate input sanitization and insufficient query preparation. An authenticated attacker with Administrator-level access or higher can append SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the Custom 404 Pro plugin to version 3.13.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-9947

Affected Products

Custom 404 Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9947 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e289988c-8bc1-4b2a-87a2-c94758d10e88?source=cve · Note
• https://t.me/CVEtracker/34675 · Telegram Post
• https://plugins.trac.wordpress.org/browser/custom-404-pro/tags/3.12.0/admin/Helpers.php#L188 · Note
• https://twitter.com/VulmonFeeds/status/1977029608538071514 · Twitter Post
• https://twitter.com/CVEnew/status/1976948516489773150 · Twitter Post