Description
The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only works on MariaDB as the query results in a syntax error on MySQL.
Published: 2025-12-13
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated SQL injection allowing data extraction
Action: Apply Patch
AI Analysis

Impact

The WordPress Filter & Grids plugin is vulnerable to SQL injection through the 'phrase' parameter, enabling unauthenticated attackers to append malicious queries and retrieve sensitive database contents. This flaw is a classic injection weakness (CWE‑89) and is limited to MariaDB, as the query produces a syntax error on MySQL.

Affected Systems

Up to and including version 3.2.0 of the YMC Filter (Filter & Grids) plugin for WordPress is affected. All installations of this plugin that have not been updated past 3.2.0 expose the vulnerable code.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, while an EPSS score of less than 1% suggests low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it via unauthenticated access to the plugin’s search functionality, provided the site uses MariaDB.

Generated by OpenCVE AI on April 22, 2026 at 03:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the newest release of the YMC Filter (Filter & Grids) plugin that is newer than 3.2.0, where the SQL injection issue is fixed.
  • If an upgrade is not feasible, disable or uninstall the YMC Filter (Filter & Grids) plugin to eliminate the unauthenticated entry point.
  • As an interim measure, configure the WordPress site to use MySQL instead of MariaDB, since the injection only works on MariaDB and will cause a syntax error on MySQL.

Generated by OpenCVE AI on April 22, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 15 Dec 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 14 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Sat, 13 Dec 2025 07:30:00 +0000

Type Values Removed Values Added
Description The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only works on MariaDB as the query results in a syntax error on MySQL.
Title Filter & Grids <= 3.2.0 - Unauthenticated SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:34:02.761Z

Reserved: 2025-09-11T17:23:05.411Z

Link: CVE-2025-10289

cve-icon Vulnrichment

Updated: 2025-12-15T15:43:00.470Z

cve-icon NVD

Status : Deferred

Published: 2025-12-13T16:16:44.830

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-10289

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T04:00:07Z

Weaknesses