CVE-2025-1446 is a critical severity SQL injection flaw (CVSS 9.8) in the Pods WordPress plugin before version 3.2.8.2. The record says a parameter is used in a SQL statement without sanitizing or escaping, and that admins can exploit it. The fix is to update Pods to 3.2.8.2 or later and review who holds admin accounts.
What's affected
The record lists the Pods plugin from Pods Foundation, every release before 3.2.8.2. Pods is a WordPress plugin for custom content types and fields, so any site running an older copy is in scope.
The record says the flaw exists before version 3.2.8.2, so version 3.2.8.2 or later is the release to be on. Confirm in the WPScan entry and the plugin changelog.
The record describes the issue as one that lets admins perform SQL injection, yet the CVSS vector rates it as needing no privileges. Those two statements do not match. Plan for the stricter reading and patch in either case.
How to check if you're exposed
If you have shell access to the WordPress host and WP-CLI installed, list the plugin and its version.
wp plugin list --name=pods --fields=name,version,status
Anything below 3.2.8.2 needs the update. In the dashboard, the same information is on the Plugins page. For many sites, the free in-browser dependency scan can also show what you run against known CVEs.
Also list your administrator accounts, since the record ties the flaw to admin access.
wp user list --role=administrator --fields=ID,user_login,user_registered
What to do now
- Update Pods to 3.2.8.2 or later from the WordPress dashboard or with WP-CLI.
- Take a database backup first, then confirm the site still loads custom content types.
- Review administrator accounts and remove any you do not need.
- Turn on two factor sign in for the accounts that remain.
- Check the WPScan entry for any detail added since the record was published.
Why it matters
SQL injection happens when user supplied text becomes part of a database command without being separated from the command itself. The weakness class is CWE-89. A successful attempt can let someone read, change or delete records, and on a WordPress site that includes user accounts and content.
The record says admins can perform the attack, which narrows who can reach it, but a single compromised admin account then becomes a path into the database. CISA does not list this CVE as known exploited, and the record gives no sign of attacks in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the quickest way to stop this class of bug?
Use prepared statements with bound parameters for every query that includes user input. Escaping by hand is easy to get wrong. Server side validation of type and length is a useful second layer.
Why does the description say admins when the score needs no privileges?
The two do not line up in the record. Assume the stricter reading and patch whichever way the vendor settles it.
Sources
This post is based on the CVE record (published 2025-03-23, source contact@wpscan.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
