CVE-2025-0723: ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0723?
CVE-2025-0723 is rated as a critical severity vulnerability due to the potential for remote code execution through SQL injection.
How do I fix CVE-2025-0723?
To fix CVE-2025-0723, upgrade the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.4.8 or later.
What versions are affected by CVE-2025-0723?
CVE-2025-0723 affects all versions of the ProfileGrid – User Profiles, Groups and Communities plugin up to and including version 5.9.4.7.
What are the attack vectors for CVE-2025-0723?
CVE-2025-0723 can be exploited through blind and time-based SQL injection using the rid and search parameters.
Is my website at risk if I have an outdated ProfileGrid plugin related to CVE-2025-0723?
Yes, having an outdated version of the ProfileGrid plugin exposes your website to the exploitation risks associated with CVE-2025-0723.