External risk intelligence

WPRecovery SQL Injection and Arbitrary File Deletion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-10726

The vulnerability affects a WordPress plugin, which is a type of web application component. WordPress sites and their plugins are commonly deployed as public-facing web applications accessible via the internet, and the flaw is exploitable by unauthenticated attackers, making it a likely target for remote interaction in standard web deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the WPRecovery WordPress plugin that could allow unauthenticated attackers to access sensitive database information or delete arbitrary files on the server. This issue stems from improper handling of user-supplied data, enabling malicious SQL queries that can be executed. The potential for unauthorized data access and file deletion highlights the importance of managing risks associated with third-party plugins.

Plugin flaw allows unauthorized data access and file deletion.
Critical impact if this plugin is in use.
Confirm relevance and assess exposure immediately.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to a vulnerable WordPress site. This allows them to manipulate database queries, potentially leading to the extraction of sensitive information and the deletion of arbitrary files on the server.

No authentication required to start.
Inject malicious SQL via a parameter.
Risk of data theft and file deletion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to extract sensitive information from the WordPress database and delete arbitrary files from the server. The SQL injection occurs when the 'data[id]' parameter is not sufficiently escaped or prepared within the query. When supported by the advisory, this could lead to unauthorized data access and system compromise.

Sensitive database information at risk.
Unauthenticated SQL injection can occur.
Arbitrary file deletion on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the WPRecovery plugin for WordPress, suggesting that WordPress administrators, application owners, and potentially the infrastructure or platform teams responsible for managing the WordPress environment are the primary points of contact. The initial practical step involves identifying all WordPress instances utilizing this plugin, confirming their exposure to the internet and business criticality, and then assigning an owner for risk assessment and remediation planning.

WordPress administrators own the issue.
Verify plugin reachability and criticality.
Plan vendor coordination or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WPRecovery plugin for WordPress?

WPRecovery is a WordPress plugin designed to assist site administrators with backup management and recovery tasks. Like many plugins, it extends the core functionality of a WordPress site by adding custom scripts that interact with the database and server filesystem to handle plugin-specific operations.

What is CWE-89 in the context of CVE-2025-10726?

CWE-89 refers to Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. In CVE-2025-10726, this means the plugin fails to properly sanitize user input before including it in a database query. This allows an attacker to manipulate the query structure, which, in this specific case, also permits the unauthorized deletion of files on the server.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a crafted web request containing malicious input through the 'data[id]' parameter. This does not require the attacker to have any existing account or administrative privileges on the WordPress site. Simply browsing to the site or sending the malformed request to the plugin's endpoint is sufficient to initiate the attack; it is not triggered by normal, legitimate site usage.

Is my site at risk if I use WPRecovery?

According to Halo Surface Signal, this vulnerability is highly relevant for public-facing web applications. Since WordPress sites are frequently deployed as internet-accessible services, and this flaw is reachable by unauthenticated users, any instance of this plugin exposed to the internet is a potential target for remote interaction.

What is the first step I should take to protect my environment?

Your immediate priority is to locate every WordPress installation in your environment that has the WPRecovery plugin installed. Once identified, evaluate whether the site is accessible from the internet and assess its criticality to your operations. If the plugin is not essential, removing it is the most effective way to eliminate the risk while you determine further mitigation or replacement strategies.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.