CVE-2025-28982 is a critical (CVSS 9.3) SQL injection flaw in the ThimPress WP Pipes WordPress plugin, versions through 1.4.3. It needs no login and no user interaction. Patchstack lists no official patch, so remove the plugin, back up your data and check the database for changes.
What's affected
The record says ThimPress WP Pipes from n/a through 1.4.3 is affected. The Patchstack page we fetched lists 1.4.3 as the vulnerable version and states that no official patch is available. Patchstack also marks the issue as a high priority one.
The record says special elements in an SQL command are not neutralised, which is SQL injection. The vector needs no privileges and no interaction, and the scope is changed, so the effect reaches beyond the plugin itself.
Severity in the record: critical, CVSS 9.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. Weakness classes: CWE-89 (SQL injection).
How to check if you're exposed
List the plugin and its version with WP-CLI:
wp plugin list --name=wp-pipes
Or open the Plugins screen and look for WP Pipes. Version 1.4.3 and anything earlier is in the range.
If you manage many WordPress sites, check them all, including staging copies. Also search your access logs for requests to paths under /wp-content/plugins/wp-pipes/ from addresses that are not yours.
What to do now
- Deactivate and remove WP Pipes if you do not need it. With no official patch listed, removal is the cleanest fix.
- If you need it, check the vendor and Patchstack for a fixed release, and apply it at once.
- Put a web application firewall in front of the site and enable rules for WordPress plugin attacks, keeping in mind it is a stopgap.
- Back up the site and database, and keep a copy offline.
- Review users, scheduled tasks and recently changed files for anything you did not do.
- Rotate the database password and WordPress salts if you suspect the site was reached.
Why it matters
SQL injection (CWE-89) happens when input is placed into a database query as text rather than passed as a parameter, so the database cannot tell the developer's query from the attacker's input. On a WordPress site the database holds user accounts, password hashes, content and settings, so the effect can range from reading data to changing it.
The vector scores high confidentiality impact, no integrity impact and low availability impact, with a changed scope. Patchstack describes this class of flaw as one that is attacked at scale, because a scanner can test thousands of sites. With no patch listed, removal and a review of the database are the safe course. The right fix in code is a prepared statement with bound parameters, which a plugin author can apply and a site owner cannot.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Try it yourself
This demo shows how a scanner tells you whether a fixed version exists, which is the first question to ask about a flaw like this one.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2025-28982?
Patchstack says no official patch is available for versions up to 1.4.3. Check the plugin page for news and consider removal.
Is CVE-2025-28982 known to be exploited?
The record does not flag it as known exploited. Patchstack describes this class of issue as one used in mass exploitation campaigns, so act promptly.
Sources
Last reviewed: 19 October 2026.
