WordPress Miraculous Theme < 2.0.9 - SQL Injection Vulnerability

The SQL Injection vulnerability in Miraculous theme allows an attacker to bypass authentication and directly query the database. Successful exploitation could lead to unauthorized access to user credentials, sensitive configuration data, and potentially even the entire WordPress database. The 'blind' nature of the injection means the attacker doesn't see the results of each query immediately, requiring iterative probing to extract data, but the potential impact remains severe. This is similar to other SQL injection vulnerabilities where attackers can gain full control over the database server.

Websites using the Miraculous WordPress theme, particularly those running older, unpatched versions (0.0.0–2.0.9), are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially expose data from others.

• wordpress / composer / npm:

grep -r "SELECT .* FROM" /var/www/html/wp-content/themes/miraculous/includes/

• generic web: ```bash curl -I https://your-wordpress-site.com/wp-admin/admin.php?page=miraculous-settings&action=updateoption&optionname=some_input' --header "X-Custom-Header: \""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

1. 2025-09-05Disclosure

   disclosure

2. 2025-09-05Patch

   patch

1. Reservado2025-09-03
2. Publicada2025-09-05
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-58628 is to immediately upgrade the Miraculous WordPress theme to version 2.0.10 or later. If upgrading is not immediately possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL injection attempts targeting the vulnerable endpoints. Specifically, look for unusual characters and patterns in user input that are commonly used in SQL injection attacks. Regularly review WordPress plugin security best practices to prevent similar vulnerabilities in the future. After upgrade, verify the fix by attempting a SQL injection attack on the vulnerable endpoint and confirming that it is blocked.