Vulnerability

CERT-In Vulnerability Note CIVN-2025-0292
SQL injection Vulnerability in WPRecovery plugin for WordPress

Original Issue Date:November 04, 2025

Severity Rating: CRITICAL

Software Affected

WordPress Plugin WPRecovery - versions up to and including 2.0

Overview

A vulnerability has been reported in WPRecovery plugin for WordPress which could allow an unauthenticated attacker to disclose sensitive information or delete arbitrary files on the targeted system.

Target Audience:
Users of affected WordPress Plugins.

Risk Assessment:
High risk of remote sensitive information disclosure and arbitrary file deletion.

Impact Assessment:
Potential for database manipulation, and denial-of-service (DoS) condition.

Description

WPRecovery is a WordPress plugin that helps website owners easily restore, back up, and recover their WordPress sites from crashes, errors, or malware attacks.

The vulnerability exists in the WPRecovery plugin for WordPress due to insufficient escaping of the user-supplied "data[id]" parameter and lack of proper preparation of the SQL query, allowing unauthenticated attackers to append additional SQL statements and extract sensitive data from the database. The injected result is then passed to PHPs unlink () function, enabling deletion of arbitrary files on the server.

Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to disclose sensitive information or delete arbitrary files on the targeted system.

Solution

Apply the necessary patches as provided by the vendor:
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wprecovery/wprecovery-20-unauthenticated-sql-injection-to-arbitrary-file-deletion

Vendor Information

WPRecovery
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wprecovery/wprecovery-20-unauthenticated-sql-injection-to-arbitrary-file-deletion

References

WordFence
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wprecovery/wprecovery-20-unauthenticated-sql-injection-to-arbitrary-file-deletion

CVE Name
CVE-2025-10726

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India