Overview
The CVE-2025-6718 is a severe security vulnerability identified in the B1.lt plugin for WordPress. This plugin is vulnerable to SQL Injection, which can potentially compromise a system or lead to data leakage. The vulnerability is due to a missing capability check on the b1_run_query AJAX action in all versions up to, and including, 2.2.56. It affects a wide range of users, specifically those utilizing the B1.lt plugin for WordPress with versions up to and including 2.2.56. With WordPress powering 39.5% of all websites in 2021, even a single vulnerability can have far-reaching implications.
Vulnerability Summary
CVE ID: CVE-2025-6718
Severity: High – 8.8 (CVSS Severity Score)
Attack Vector: Network
Privileges Required: Low (Subscriber-level access)
User Interaction: Required
Impact: Potential system compromise or leakage of data
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
B1.lt Plugin for WordPress | Up to and including 2.2.56
How the Exploit Works
This vulnerability stems from a missing capability check on the b1_run_query AJAX action. This oversight allows authenticated attackers, with Subscriber-level access and above, to execute and run arbitrary SQL commands. By crafting and executing malicious SQL commands, an attacker can manipulate the database, potentially leading to data breaches or complete system compromise.
Conceptual Example Code
Here’s a
conceptual
example of how the vulnerability might be exploited:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: targetwebsite.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_[hash]=[username]%7C[expiry]%7C[signature]
action=b1_run_query&query=DROP TABLE wp_users;In this conceptual example, an authenticated attacker sends a POST request to the ‘admin-ajax.php’ file, triggering the ‘b1_run_query’ action and executing the malicious SQL command to drop the ‘wp_users’ table, thereby potentially compromising the system.
Recommended Mitigation
Users are advised to apply the vendor patch as soon as it is available. In the meantime, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used for temporary mitigation. Regularly updating and patching software, along with proper access controls and monitoring, can also help prevent such vulnerabilities.