CVE-2021-25070: WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-28 · updated 2026-06-17
Weakness: CWE-89

Description

The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue

Affected products

Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: before 6.88 — fixed in 6.88

How to fix

Upgrade to a fixed version: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection 6.88. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e00b2946-15e5-4458-9b13-2e272630a36f
https://wpscan.com/vulnerability/e00b2946-15e5-4458-9b13-2e272630a36f

Get alerted when CVE-2021-25070 or the next vulnerability affects your stack