CVE-2025-2011

CVE-2025-2011 is an unauthenticated SQL injection (CWE-89) in the Slider & Popup Builder by Depicter plugin for WordPress, present in all versions up to and including 3.6.1. The plugin insufficiently escapes the user-supplied 's' parameter and does not adequately prepare the existing SQL query, allowing an unauthenticated attacker to append additional SQL queries to already-existing queries via crafted network requests that require no privileges or user interaction. Successful exploitation allows attackers to extract sensitive information from the WordPress database, potentially including user data and credentials, though it does not directly permit code execution or data modification. Any WordPress site running the plugin at version 3.6.1 or earlier is affected, with the exposure bounded by the plugin's install base of roughly tens of thousands of sites. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known yet, but the elevated EPSS score (46.4% probability of exploitation within 30 days, 99th percentile) indicates defenders should patch promptly.

What to do: Update Slider & Popup Builder by Depicter to the latest patched release (anything newer than 3.6.1 addresses this flaw) as soon as possible. As an interim mitigation, apply WAF/virtual-patching rules that inspect the 's' parameter for SQL syntax on unauthenticated requests, and review access logs for requests where 's' contains quotes or SQL keywords (e.g., UNION, SELECT, SLEEP) plus any anomalous database errors, given the elevated likelihood of exploitation.