● Critical · CVSS 9.8

How to Fix CVE-2025-28983: CWE-89 Improper Neutralization of Special Elements used in an SQL Command in Click & Pledge Connect

Q: Is CVE-2025-28983 being actively exploited?

Not at the time of writing. It is not listed in CISA's Known Exploited Vulnerabilities catalog. That can change, so monitor the advisory and KEV catalog.

Q: How severe is CVE-2025-28983?

CVSS rates it 9.8 (Critical). Treat it accordingly in your prioritisation queue.

Q: Do I have to take Click & Pledge Connect offline to apply the patch?

That depends on your deployment topology. For high-availability or clustered setups you can usually patch one node at a time with no full outage. Standalone installs typically need a short restart. Always follow the vendor's documented upgrade steps.

⚡ At a glance


Severity	CVSS 9.8, Critical
Actively exploited?	No
Affected	ClickandPledge Click & Pledge Connect (<= WP6.8)
Fixed in	Newer than WP6.8 (per vendor advisory)
Type (CWE)	CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

What is CVE-2025-28983?

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.

In short, a successful attacker gets SQL injection that can read or modify the backing database. No confirmed in-the-wild exploitation is listed in CISA KEV at the time of writing, but the CVSS rating still warrants prompt patching.

Am I affected?

Check whether you run Clickandpledge Click & Pledge Connect in your environment, then compare your installed version against the Affected row above.

Check the installed version against the Affected row above using the product's standard version command or admin UI.

How to fix CVE-2025-28983

Read the official vendor advisory linked at the bottom of this page and identify the exact patched build for your release train.
Download the patched build of Click & Pledge Connect from the vendor's support portal. Use only signed images from the vendor.
Back up configuration and, where supported, take a snapshot of the host or appliance before you start.
Apply the update following the vendor's documented procedure. For clustered or high-availability deployments, patch the standby node first, fail over, then patch the previously active node.
Restart the affected service or appliance if the upgrade procedure requires it.
Re-run the version check from the previous section and confirm the build matches the fixed release.

Apply the Microsoft security update


# The exact KB number is listed in the Microsoft advisory: https://patchstack.com/database/wordpress/plugin/click-pledge-connect/vulnerability/wordpress-click-pledge-connect-plugin-25-04010101-wp6-8-privilege-escalation-via-sql-injection-vulnerability?_s_id=cve
# Confirm the patch is missing on this host
Get-Hotfix -Id <KB-from-advisory> -ErrorAction SilentlyContinue

# Install the rollup that ships the fix
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Import-Module PSWindowsUpdate
Get-WindowsUpdate -KBArticleID <KB-from-advisory> -AcceptAll -Install -AutoReboot

# Verify the patch is now present
Get-Hotfix -Id <KB-from-advisory>


# Inventory missing patches across a Windows fleet via Ansible (winrm)
ansible windows -m win_updates -a "category_names=SecurityUpdates state=installed"

Verify the fix landed


# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://patchstack.com/database/wordpress/plugin/click-pledge-connect/vulnerability/wordpress-click-pledge-connect-plugin-25-04010101-wp6-8-privilege-escalation-via-sql-injection-vulnerability?_s_id=cve
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2025-28983 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch immediately

If the patch cannot be applied immediately, restrict access to the vulnerable endpoint via firewall or WAF rules and enable verbose logging on the affected component so you can detect attempted exploitation. These are stopgaps, not a replacement for the patched build.

How to verify the fix worked

Confirm the running build of Click & Pledge Connect matches the fixed version listed by the vendor. Re-run any vulnerability scanner you used previously and confirm the finding for CVE-2025-28983 has cleared. Where the vendor publishes a detection rule or IOCs, sweep your logs for evidence of pre-patch exploitation.

Why this CVE matters

CVSS 9.8 (Critical) reflects either remote, unauthenticated exploitability, full impact on confidentiality / integrity / availability, or both. Most internal SLAs map a Critical rating to a 7-to-15 day patch deadline regardless of in-the-wild reports. Public-facing instances should be patched on the shorter end of that window.

Monitoring and detection

After you apply the patch, treat the affected component as a known-good baseline and watch for regression. Concrete steps:

Re-run your usual vulnerability scanner on a weekly cycle for the next month and confirm the finding stays clear.
Forward the affected component's logs to your SIEM, then write a rule for any failed-auth burst or unusual configuration change on the component.
If the vendor advisory lists indicators of compromise, hash patterns, or specific log strings, build detection rules in your SIEM around them and back-search the last 90 days of logs.
Tag the patched build in your CMDB so future audits can confirm it stayed patched through any rebuild or re-image.

Defensive hardening beyond the patch

Patching closes this specific CVE. A few common-sense controls reduce the blast radius of the next one in the same component:

Restrict network access to the affected component to known administrative networks at the firewall.
Enable verbose audit logging and forward events to your SIEM for at least 90 days.
Enforce two-factor authentication on any account that can administer the affected component.
Run a fresh asset inventory after the patch to confirm no shadow instances were missed.

Frequently asked questions

Other vulnerabilities in the same area that are worth patching alongside this one:

How to Fix CVE-2025-42999: Deserialization RCE in SAP NetWeaver (Visual Composer development server) — Deserialization RCE in SAP NetWeaver (Visual Composer development server)
How to Fix CVE-2025-39406: Improper Control of Filename for Include/Require Statement in PHP Program in WPAMS — Improper Control of Filename for Include/Require Statement in PHP Program in WPAMS
How to Fix CVE-2025-6380: CWE-862 Missing Authorization in ONLYOFFICE Docs , CWE-862 Missing Authorization in ONLYOFFICE Docs
How to Fix CVE-2025-12480: Access Control Bypass in TrioFox , Access Control Bypass in TrioFox
How to Fix CVE-2025-23310: CWE-121 Stack-based Buffer Overflow in Triton Inference Server , CWE-121 Stack-based Buffer Overflow in Triton Inference Server

Is CVE-2025-28983 being actively exploited?