DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery zu (SQL Injection)

The SQL Injection vulnerability in DASHBOARD BUILDER allows an attacker to execute arbitrary SQL queries against the WordPress database. This can lead to a wide range of malicious activities, including data exfiltration (stealing user credentials, financial information, or other sensitive data), data modification (altering website content or user profiles), and even complete database takeover. Successful exploitation hinges on tricking a site administrator into clicking a malicious link containing a forged request. The ability to modify database credentials elevates the risk significantly, potentially granting the attacker persistent access to the entire WordPress installation.

WordPress websites utilizing the DASHBOARD BUILDER plugin, particularly those with shared hosting environments, are at risk. Sites with weak administrator password policies or those that haven't implemented proper access controls are especially vulnerable. Legacy WordPress installations running older versions of PHP may also be more susceptible due to potential differences in SQL query parsing.

• wordpress / composer / npm:

grep -r "dashboardbuilder-admin.php" /var/www/html/

• wordpress / composer / npm:

wp plugin list | grep DASHBOARD BUILDER

• wordpress / composer / npm:

wp plugin update --all

• generic web: Check for unusual database activity in WordPress error logs, specifically related to SQL queries originating from the DASHBOARD BUILDER plugin.

1. 2026-01-14Disclosure

   disclosure

1. Reserviert2025-12-12
2. Veröffentlicht2026-01-14
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-14615 is to upgrade to a patched version of the DASHBOARD BUILDER plugin once available. In the interim, implement a Web Application Firewall (WAF) with rules to filter out potentially malicious requests targeting the dashboardbuilder-admin.php file. Specifically, look for requests containing unusual SQL syntax or attempts to manipulate database credentials. Consider temporarily disabling the [show-dashboardbuilder] shortcode to reduce the attack surface. After applying any mitigation, verify its effectiveness by attempting to trigger the vulnerability with a controlled test request.