Platform
wordpress
Component
social-share-and-social-locker-arsocial
Opgelost in
1.4.3
CVE-2025-31911 describes a critical SQL Injection vulnerability discovered in the Social Share And Social Locker WordPress plugin. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data access and manipulation. The vulnerability affects versions from 0 up to and including 1.4.2, and a patch is available in version 1.4.3.
The SQL Injection vulnerability in Social Share And Social Locker allows attackers to bypass security measures and directly interact with the underlying database. Due to the 'blind' nature of the injection, attackers must infer data through multiple queries, making exploitation potentially time-consuming but still highly impactful. Successful exploitation could lead to the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially even financial information if the plugin handles such data. Furthermore, an attacker could modify database records, leading to data corruption or denial of service. This vulnerability shares characteristics with other SQL injection flaws, where attackers leverage malformed SQL queries to gain unauthorized access.
CVE-2025-31911 was publicly disclosed on 2025-04-03. The vulnerability's severity is high due to the potential for data exfiltration and modification. Currently, there are no known public exploits or active campaigns targeting this specific vulnerability, but the blind SQL injection nature means exploitation is possible. It is not listed on the CISA KEV catalog as of this writing.
WordPress websites utilizing the Social Share And Social Locker plugin, particularly those running versions 0 through 1.4.2, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others.
• wordpress / composer / npm:
grep -r "reputeinfosystems/social-share-and-social-locker" wp-content/plugins/• wordpress / composer / npm:
wp plugin list | grep "Social Share And Social Locker"• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/social-share-and-social-locker/ | grep -i "SQL"• generic web: Review WordPress access logs for unusual SQL query patterns originating from the plugin’s endpoints.
disclosure
Exploit Status
EPSS
0.23% (46% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2025-31911 is to immediately upgrade the Social Share And Social Locker plugin to version 1.4.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. While a direct WAF rule is difficult to implement for blind SQL injection, implementing a WAF rule that blocks suspicious SQL query patterns targeting the plugin's endpoints could offer some protection. Monitor WordPress access logs for unusual SQL query patterns originating from the plugin’s endpoints. After upgrading, confirm the vulnerability is resolved by attempting a test SQL injection query through the plugin’s functionality and verifying that it is properly sanitized.
Actualice el plugin Social Share And Social Locker a la última versión disponible para mitigar la vulnerabilidad de inyección SQL ciega. Verifique las actualizaciones en el repositorio de WordPress o contacte al desarrollador para obtener más información sobre la versión corregida. Implemente medidas de seguridad adicionales, como la validación y el saneamiento de las entradas del usuario, para prevenir futuras vulnerabilidades.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2025-31911 is a critical SQL Injection vulnerability affecting versions 0–1.4.2 of the Social Share And Social Locker WordPress plugin, allowing attackers to extract data via blind SQL injection.
If your WordPress site uses Social Share And Social Locker version 0 through 1.4.2, you are vulnerable to this SQL Injection flaw. Upgrade immediately.
Upgrade the Social Share And Social Locker plugin to version 1.4.3 or later to resolve this vulnerability. If upgrading is not possible, temporarily disable the plugin.
As of now, there are no confirmed active exploitation campaigns targeting CVE-2025-31911, but the blind SQL injection nature makes exploitation possible.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and update information regarding CVE-2025-31911.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.