WordPress postMash – custom post order Plugin <= 1.2.0 is vulnerable to SQL Injection

Successful exploitation of this SQL Injection vulnerability could allow an attacker to bypass authentication, read sensitive data (such as user credentials, post content, and configuration details), modify data, or even execute arbitrary commands on the server. The blast radius extends to any data stored within the WordPress database accessible through the vulnerable plugin. Depending on the database user permissions, an attacker could potentially gain complete control over the WordPress installation and the underlying server. This vulnerability shares characteristics with other SQL Injection flaws, where improper input validation leads to the execution of unintended SQL queries.

WordPress websites utilizing the postMash – custom post order plugin, particularly those running versions prior to 1.2.1, are at risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r "postMash" /var/www/html/wp-content/plugins/
wp plugin list | grep postMash

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin.php?page=postmash-custom-post-order

• database (mysql):

SELECT VERSION(); --'

• wordpress / composer / npm:

wp plugin auto-update postmash-custom-post-order

1. 2024-02-28Disclosure

   disclosure

1. Réservé2024-02-12
2. Publiée2024-02-28
3. Modifiée2024-08-03
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-25927 is to immediately upgrade the postMash – custom post order plugin to version 1.2.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL queries targeting the plugin's endpoints. Specifically, look for patterns indicative of SQL injection attempts, such as the presence of single quotes, double quotes, semicolons, or SQL keywords in user-supplied input. Regularly review database user permissions to ensure they adhere to the principle of least privilege.