CVE-2025-13090

Executive Summary

CVE-2025-13090 is a critical SQL Injection vulnerability discovered in the WP Directory Kit plugin for WordPress, affecting all versions up to and including 1.4.6. The flaw resides in the insufficient sanitization of the search parameter, allowing authenticated attackers with Administrator-level privileges to inject arbitrary SQL queries. This can lead to the extraction of sensitive information from the WordPress database, including user credentials, session tokens, and other confidential data. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the potential impact on WordPress sites.

WordPress Ecosystem Context

This vulnerability is specific to the WP Directory Kit plugin, a component of the WordPress ecosystem. It is not related to Apache or Nginx server configurations. The attack vector is through the WordPress admin interface, requiring authenticated access with elevated privileges.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – The attacker must have Administrator-level access to the WordPress site.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive data can be extracted.
• Integrity (I): None – Data cannot be modified.
• Availability (A): None – Service availability is not impacted.

Threat Level: Medium. While the CVSS score is moderate, the requirement for high privileges reduces the immediate risk. However, once an attacker gains admin access, the impact on confidentiality is severe.

Deep Dive & Mechanics

The vulnerability exists in the search parameter of the WP Directory Kit plugin. The plugin fails to properly escape user-supplied input and does not prepare the SQL query adequately. This allows an authenticated administrator to inject malicious SQL code into the query, which is then executed against the WordPress database.

Root Cause:

• Insufficient input sanitization: The search parameter is not properly escaped before being used in an SQL query.
• Lack of prepared statements: The plugin uses dynamic SQL query construction without parameterized queries, making it vulnerable to injection.

Attack Flow:

1. An authenticated administrator accesses the WP Directory Kit admin interface.
2. The attacker manipulates the search parameter in a request (e.g., via a crafted HTTP POST or GET request).
3. The malicious SQL payload is appended to the existing query, allowing the attacker to extract data from other tables (e.g., wp_users, wp_usermeta).
4. The attacker can retrieve sensitive information such as user passwords (hashed), email addresses, and session tokens.

Example Payload (Conceptual):

' OR 1=1 UNION SELECT user_login, user_pass FROM wp_users --

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's search functionality. A secure implementation would use prepared statements or parameterized queries.

Vulnerable Code (Conceptual):

$search = $_POST['search'];
$query = "SELECT * FROM wp_directory WHERE name LIKE '%$search%'";
$result = $wpdb->get_results($query);

Patched Code (Conceptual):

$search = sanitize_text_field($_POST['search']);
$query = $wpdb->prepare("SELECT * FROM wp_directory WHERE name LIKE %s", '%' . $search . '%');
$result = $wpdb->get_results($query);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with WP Directory Kit plugin version <= 1.4.6.
• Administrator credentials.

Exploitation Steps:

1. Log in to WordPress as an administrator.
2. Navigate to the WP Directory Kit admin page.
3. Intercept the search request using a proxy (e.g., Burp Suite).
4. Modify the search parameter to include a SQL injection payload.
5. Observe the response for extracted data.

Example Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: [admin session cookie]

action=wpdk_search&search=' UNION SELECT user_login, user_pass FROM wp_users --

Expected Output: The response may contain user credentials from the wp_users table.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL queries in database logs.
• Look for requests with suspicious characters in the search parameter (e.g., single quotes, UNION, SELECT).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Mitigation:

• Disable the WP Directory Kit plugin until a patch is available.
• Restrict admin access to trusted users only.
• Implement input validation and parameterized queries in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=wpdk_search and suspicious search parameter values.
  • Database queries containing UNION, SELECT, or FROM in the search context.

• File IOCs:

  • Modified plugin files (e.g., wp-content/plugins/wp-directory-kit/).
  • Unexpected entries in WordPress database tables (e.g., wp_options).

• Log IOCs:

  • WordPress debug logs showing SQL errors.
  • Web server access logs with unusual SQL-like patterns in the request URI.

Detection Engineering

YARA Rule

rule CVE_2025_13090_WP_Directory_Kit_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WP Directory Kit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13090"
    strings:
        $s1 = "wpdk_search" ascii wide nocase
        $s2 = "search=" ascii wide nocase
        $s3 = "UNION" ascii wide nocase
        $s4 = "SELECT" ascii wide nocase
        $s5 = "FROM" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-13090 WP Directory Kit SQL Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against WP Directory Kit plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wpdk_search'
        cs-uri-query|contains: 'search='
        cs-uri-query|re: '.*(UNION|SELECT|FROM).*'
    condition: selection
falsepositives:
    - Legitimate admin searches with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13090 WP Directory Kit SQL Injection"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpdk_search"; http_client_body; content:"search="; http_client_body; pcre:"/(UNION|SELECT|FROM)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and uninstall WP Directory Kit until a patch is released.
2. Restrict admin access: Limit the number of users with Administrator privileges.
3. Monitor logs: Review web server and database logs for signs of exploitation.

Long-term Fixes:

• Apply patch: Once the vendor releases an update, upgrade to the patched version immediately.
• Implement WAF: Use a Web Application Firewall to block SQL injection attempts.
• Code review: If you have custom code, ensure all SQL queries use prepared statements.

Workarounds:

• Use a security plugin (e.g., Wordfence) to add an additional layer of protection.
• Manually sanitize the search parameter in the plugin code (if you have access) by adding esc_sql() or using $wpdb->prepare().

Valters IT
Securing Digital Frontiers