Description
The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-11-25
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The ProjectList WordPress plugin includes a time‑based SQL injection flaw in the 'id' parameter across all releases up to and including 0.3.0. An authenticated user with Editor privileges could manipulate this parameter to append arbitrary SQL statements to the existing query, allowing the extraction of sensitive database contents. The weakness is a classic injection failure (CWE‑89) and does not grant remote code execution, but it can compromise confidential data stored in the WordPress database.

Affected Systems

The affected plugin is ProjectList, developed by vendor ov3rkll for WordPress. All versions numbered 0.3.0 or earlier are susceptible; newer releases are assumed to have addressed the issue.

Risk and Exploitability

The CVSS score of 4.9 positions the flaw at moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation under current conditions. Since the vulnerability requires a user to be logged in with Editor or higher privileges, its operational impact is limited to sites where such accounts exist, and it is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 21, 2026 at 17:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ProjectList to any version newer than 0.3.0, removing the insecure handling of the 'id' parameter.
  • If an upgrade cannot be performed immediately, restrict access to the 'id' parameter or disable the associated pages for Editor and higher roles to reduce the attack window.
  • Configure a web application firewall or custom rule set to block SQL injection patterns in the 'id' parameter to mitigate residual risk.

Generated by OpenCVE AI on April 21, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 01 Dec 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 25 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Nov 2025 07:45:00 +0000

Type Values Removed Values Added
Description The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:29:32.160Z

Reserved: 2025-11-18T18:09:21.567Z

Link: CVE-2025-13370

cve-icon Vulnrichment

Updated: 2025-11-25T14:35:14.351Z

cve-icon NVD

Status : Deferred

Published: 2025-11-25T08:15:49.667

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-13370

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T18:00:11Z

Weaknesses