Attack Vectors

CVE-2025-32297 affects the Simple Link Directory / Simple Link Directory Pro WordPress plugin (slug: qc-simple-link-directory) in versions prior to 14.8.1. The issue is rated Medium severity with a CVSS 6.5 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

The attack requires an authenticated WordPress account with Subscriber-level access or higher. In practical terms, that means the risk increases for sites that allow public registration, have many user accounts (customers, members, partners), or maintain accounts that are not regularly reviewed and removed.

Because the vulnerability is exploitable over the network and does not require user interaction, a malicious user (or an attacker who hijacks a low-privilege account) can attempt to extract data from the site’s database by manipulating a plugin parameter.

Reference: CVE-2025-32297 record and the vendor research source: Wordfence vulnerability advisory.

Security Weakness

This is an SQL Injection vulnerability caused by insufficient escaping of a user-supplied parameter and a lack of sufficient preparation of an existing SQL query in affected versions of the Simple Link Directory plugin (up to, but not including, 14.8.1).

SQL injection weaknesses can allow an attacker to alter how database queries run. In this case, the published summary indicates authenticated attackers may be able to append additional SQL to an existing query, enabling them to extract sensitive information from the WordPress database.

Technical or Business Impacts

The most significant risk highlighted by the CVSS vector is confidentiality impact (C:H). Depending on what data is stored in your WordPress database, this can include business-sensitive information such as user records, email addresses, content not meant to be public, or other stored site data.

For marketing and executive stakeholders, the business impact typically shows up as: potential privacy exposure, loss of customer trust, incident response costs, and possible compliance implications if personal data is accessed. Even though the severity is categorized as Medium, the requirement for only low-level authentication means the vulnerability can still be operationally risky on sites with open registration or large numbers of accounts.

Remediation: Update Simple Link Directory to version 14.8.1 or a newer patched version. After patching, consider reviewing user registration settings, auditing subscriber accounts, and ensuring least-privilege access (only grant roles necessary for business needs).

Similar Attacks

SQL injection has a long history of being used to access sensitive data when input handling is insufficient. Well-known real-world examples include:

Drupal “Drupageddon” (SA-CORE-2014-005): A widely exploited SQL injection vulnerability that led to mass compromise of websites running affected versions of Drupal.
https://www.drupal.org/SA-CORE-2014-005

TalkTalk breach (2015): A major UK telecom incident where attackers exploited a web vulnerability reported as SQL injection, leading to significant customer data exposure and business fallout.
https://ico.org.uk/action-weve-taken/enforcement/talktalk-telecom-group-plc/