Description
The Vibes plugin for WordPress is vulnerable to time-based SQL Injection via the ‘resource’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-08-26
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated SQL Injection leading to database data extraction
Action: Apply Patch
AI Analysis

Impact

The Vibes WordPress plugin contains a time‑based SQL Injection flaw in the ‘resource’ parameter. Insufficient escaping and lack of prepared statements allow unauthenticated attackers to append malicious SQL clauses to existing queries, enabling extraction of sensitive data from the database. This vulnerability is classified as CWE‑89.

Affected Systems

All versions of the Vibes plugin from pierrelannoy up to and including 2.2.0 are affected. Users running any of these releases on a WordPress site are susceptible to the exploit.

Risk and Exploitability

The CVSS score is 7.5, reflecting a high severity. The EPSS score of less than 1% suggests exploitation is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the vulnerable parameter directly from the web interface without authentication, making it a web‑based injection that can be triggered by any visitor to the site.

Generated by OpenCVE AI on April 21, 2026 at 19:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch available from the vendor that removes the injection point.
  • If an update cannot be applied immediately, disable or delete the Vibes plugin to close the attack surface.
  • Implement strict input validation or prepared statements for the ‘resource’ parameter to prevent future injection vectors.

Generated by OpenCVE AI on April 21, 2026 at 19:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-25791 The Vibes plugin for WordPress is vulnerable to time-based SQL Injection via the ‘resource’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
History

Tue, 26 Aug 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 26 Aug 2025 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 26 Aug 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Vibes plugin for WordPress is vulnerable to time-based SQL Injection via the ‘resource’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title Vibes <= 2.2.0 - Unauthenticated SQL Injection via `resource` Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:01:53.116Z

Reserved: 2025-08-19T13:38:06.961Z

Link: CVE-2025-9172

cve-icon Vulnrichment

Updated: 2025-08-26T13:36:03.443Z

cve-icon NVD

Status : Deferred

Published: 2025-08-26T04:15:49.197

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-9172

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T19:30:06Z

Weaknesses