CVE-2025-1323 is a high severity SQL injection (CVSS 7.5) in the WP-Recall plugin for WordPress, in all versions up to and including 16.26.10. Unauthenticated attackers can extract data through the databeat parameter. Update to a release newer than 16.26.10 and confirm the exact fixed version in the advisory.
What's affected
The affected product is the WP-Recall plugin (Registration, Profile, Commerce and More). The record says every version up to and including 16.26.10 is vulnerable. The vulnerable code path is the databeat parameter, and the record lists a plugin changeset against add-on/rcl-chat/core.php, which points at the chat add-on that ships with the plugin.
The record does not name a fixed version number. The fix is described by a changeset in the WordPress plugin repository, so a release that includes that change is the one you want. Check the plugin page or the Wordfence entry for the exact number before you record it as remediated.
The weakness is CWE-89. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: network reachable, no privileges, no user interaction, and a high confidentiality impact with no integrity or availability impact. In other words, it is about reading data. The record's kev flag is false.
How to check if you're exposed
From the WordPress admin, open Plugins and look for WP-Recall. The version is shown under the plugin name. If you manage sites from the command line with WP-CLI, this is faster across many sites:
wp plugin list --name=wp-recall --fields=name,status,version
If the version is 16.26.10 or lower, you are in the affected range. On a fleet, run the same command through your site management tooling and collect the output in one table.
Also check whether the chat add-on is active, since the changeset in the record touches it. If the plugin is installed but inactive, the risk is lower, but the safest choice is still to update or remove it.
To track plugins and libraries across your own repositories, the free in-browser dependency scan gives a quick inventory.
What to do now
- List every WordPress site you run and check for the WP-Recall plugin and its version.
- Update to the latest release from the WordPress plugin directory, and confirm the version is newer than 16.26.10.
- Read the Wordfence entry linked in the sources to confirm the fixed version for your record.
- If you cannot update today, deactivate the plugin or the chat add-on until you can.
- Look at web server logs for odd values in the
databeatparameter since March 2025, and treat any hits as a sign to review what the database holds. - If the site stores customer data, rotate secrets kept in the database, such as API keys, and consider forcing password resets if you see signs of probing.
- Turn on automatic plugin updates for security releases where your change process allows it.
Why it matters
The description says the plugin did not escape the user supplied parameter enough and did not use a prepared version of the existing query. That is the classic recipe for CWE-89: input meant as a value gets read as part of the SQL statement. Because the weakness can be reached without logging in, any visitor to the site can try it.
WordPress sites run a lot of plugins, and each one is separate code with its own mistakes. A site is only as safe as its least careful plugin. Keeping an inventory with versions, and removing plugins you no longer use, is the cheapest way to shrink that risk.
Quick check
Does the attacker need an account?
No. The record says unauthenticated attackers can use the flaw, and the CVSS vector shows no privileges required.
Which version is safe?
The record only says versions up to 16.26.10 are affected. Use the plugin directory or the Wordfence entry to confirm the first fixed release.
Sources
- Safeguard Gold entry for CVE-2025-1323
- https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ae5b4d81-c2f1-4d0d-b7b0-5556bf0451f5?source=cve
Last reviewed: 19 October 2026.
