CVE-2025-28983

WordPress Click & Pledge Connect plugin <= 25.04010101-WP6.8 - Privilege Escalation via SQL Injection vulnerability

View on CVE.org
Published Jul 4, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.

Analysis

AI-generated

Technical impact

Improper neutralization of special elements used in an SQL command allows an attacker to inject malicious SQL code. The vulnerability can elevate a low‑privileged user’s authority, permitting unauthorized data access, modification, or deletion. It is a classic SQL Injection flaw (CWE‑89) that reaches the application’s core functionality.

Affected Systems

The Click & Pledge Connect plugin for WordPress is affected. Any installation using plugin versions from 25.04010101 up through WP6.8 is vulnerable. The problem originates from the database interaction layer of the plugin.

Risk and Exploitability

The CVSS score of 9.8 signals critical severity. The EPSS score is below 1%, indicating a low probability of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Likely attackers would send crafted requests to the plugin’s endpoints as an authenticated user with limited privileges, taking advantage of the SQL injection to gain higher privileges or alter data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Click & Pledge Connect to the latest release that resolves the SQL injection flaw. If an upgrade is not immediately possible, roll back to a known secure version of the plugin or sandbox the site until the fix can be applied.
  • Configure the database user used by WordPress to have strictly the minimum privileges required for normal operation; avoid granting EXECUTE or ALTER rights that would allow elevation from injected code.
  • Deploy an application firewall or input‑validation layer that detects and blocks suspicious SQL patterns before they reach the database engine; monitor for failed injection attempts to alert on possible exploitation attempts.

Generated by OpenCVE AI on April 30, 2026 at 16:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-19973 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.
History
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect click-pledge-connect allows Privilege Escalation.This issue affects Click & Pledge Connect: from n/a through <= 25.04010101-WP6.8. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.
References
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect click-pledge-connect allows Privilege Escalation.This issue affects Click & Pledge Connect: from n/a through <= 25.04010101-WP6.8.
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.
Title WordPress Click & Pledge Connect plugin <= 25.04010101-WP6.8 - Privilege Escalation via SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (1)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Mar 11, 2025, 8:10 AM

View source JSON

Updated
Jul 7, 2025, 2:04 PM

JSON

Status
Deferred
Published
Jul 4, 2025, 12:15 PM
Modified
Jun 17, 2026, 9:04 AM

View source JSON

No data.

Updated
Apr 30, 2026, 5:00 PM

JSON