Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2025-31531 β€” AI Deep Analysis Summary

CVSS 9.3 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in 'History Log by click5'. πŸ’₯ **Consequences**: Attackers can manipulate SQL commands via improper handling of special elements.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. πŸ” **Flaw**: The plugin fails to sanitize user inputs before executing database queries, allowing malicious SQL code injection.

Q3Who is affected? (Versions/Components)

🏒 **Vendor**: click5. πŸ“¦ **Product**: History Log by click5 (WordPress Plugin). πŸ“‰ **Affected Versions**: 1.0.13 and earlier.

Q4What can hackers do? (Privileges/Data)

πŸ•΅οΈ **Privileges**: No authentication required (PR:N). πŸ“Š **Data Impact**: High Confidentiality (C:H), Low Availability (A:L).…

Q5Is exploitation threshold high? (Auth/Config)

πŸ“‰ **Threshold**: LOW. πŸ”“ **Auth**: None required (PR:N). 🌐 **Access**: Network remote (AV:N). ⚑ **Complexity**: Low (AC:L). Easy to exploit for anyone with network access.

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ“œ **Public Exp?**: No specific PoC provided in data. 🌍 **Wild Exploitation**: Possible due to low complexity and no auth requirement. VDB entries exist on Patchstack.

Q7How to self-check? (Features/Scanning)

πŸ” **Self-Check**: Scan for 'History Log by click5' plugin version. πŸ› οΈ **Tooling**: Use WP scanners or check plugin directory for version < 1.0.13. ⚠️ **Indicator**: Look for SQLi errors in logs when interacting with plug…

Q8Is it fixed officially? (Patch/Mitigation)

πŸ”§ **Fix**: Update plugin to version > 1.0.13. πŸ“₯ **Source**: Check official WordPress plugin repository or vendor site. βœ… **Status**: Patch available (implied by version cutoff).

Q9What if no patch? (Workaround)

🚫 **No Patch?**: Disable the plugin immediately. πŸ›‘οΈ **Mitigation**: Use WAF rules to block SQLi patterns. πŸ”’ **Access Control**: Restrict plugin access if possible. Monitor DB logs for anomalies.

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency**: HIGH. πŸ“ˆ **CVSS**: 7.5 (High). ⏳ **Priority**: Patch immediately. No auth needed makes it critical for exposed sites. Protect sensitive data first.