WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion

The SQL Injection vulnerability in WPRecovery allows attackers to manipulate database queries directly. An attacker could leverage this to extract sensitive information such as user credentials, customer data, or configuration details stored within the WordPress database. Furthermore, the vulnerability’s exploitation allows the attacker to use the unlink() function, enabling them to delete arbitrary files on the server, potentially disrupting the website's functionality or even compromising the entire system. This represents a significant risk, particularly for sites handling sensitive user data or critical business information.

WordPress websites utilizing the WPRecovery plugin, particularly those handling sensitive user data or operating in environments with limited security controls, are at significant risk. Shared hosting environments where plugin updates are managed by the hosting provider are also particularly vulnerable if they haven't applied the update.

• wordpress / composer / npm:

grep -r "data[id]" /var/www/html/wp-content/plugins/wp-recovery/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/wp-recovery/ | grep SQL

• wordpress / composer / npm:

wp plugin list | grep wp-recovery

1. 2025-10-03Disclosure

   disclosure

1. 予約済み2025-09-19
2. 公開日2025-10-03
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-10726 is to immediately upgrade the WPRecovery plugin to version 2.5.4 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider temporarily disabling the WPRecovery plugin to prevent exploitation. While not a complete solution, implementing a Web Application Firewall (WAF) with SQL Injection protection rules can provide an additional layer of defense. Regularly review WordPress plugin security best practices and ensure all plugins are from reputable sources.