CVE-2025-14719

Executive Summary

CVE-2025-14719 is a critical SQL Injection vulnerability affecting the Relevanssi and Relevanssi Premium WordPress plugins. The flaw allows authenticated users with Contributor-level roles or higher to inject arbitrary SQL commands due to insufficient sanitization and escaping of a parameter before its use in a database query. This can lead to unauthorized data access, modification, or deletion, and potentially full site compromise. The vulnerability is present in Relevanssi versions before 4.26.0 and Relevanssi Premium versions before 2.29.0. No public proof-of-concept or exploit code is currently available, but the risk is significant given the widespread use of these plugins for search functionality.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Relevanssi plugin is distributed through the official WordPress plugin repository and the Relevanssi Premium plugin via the vendor's site. Users are advised to update directly from the plugin's admin panel or by downloading the latest version from the vendor. No third-party package managers (NPM, PyPI, Go, Ruby) are involved.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability details, a reasonable CVSS v3.1 vector would be:

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score: 8.8 (High)

Breakdown:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a Contributor-level account or higher.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Threat Level: High. The combination of low privileges required and high impact makes this a serious threat for any WordPress site using the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability resides in the Relevanssi plugin's search functionality. The plugin fails to properly sanitize and escape a user-supplied parameter before incorporating it into a SQL query. Specifically, the parameter is likely used in a LIKE clause or similar SQL construct without being passed through WordPress's $wpdb->prepare() or equivalent escaping functions.

Technical Flow:

1. An authenticated user with Contributor role or higher submits a search request.
2. The plugin receives the search term and constructs a SQL query.
3. The search term is directly concatenated into the query string without proper escaping.
4. An attacker can inject SQL commands by including special characters (e.g., single quotes, UNION statements) in the search term.
5. The injected SQL is executed against the WordPress database, allowing the attacker to read, modify, or delete data.

Affected Components:

• Relevanssi (free version) < 4.26.0
• Relevanssi Premium < 2.29.0

Root Cause: Lack of input validation and failure to use parameterized queries or prepared statements.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$search_term = $_POST['s'];
$query = "SELECT * FROM wp_posts WHERE post_title LIKE '%" . $search_term . "%'";
$results = $wpdb->get_results($query);

Patched Code (Conceptual):

$search_term = sanitize_text_field($_POST['s']);
$query = $wpdb->prepare("SELECT * FROM wp_posts WHERE post_title LIKE %s", '%' . $search_term . '%');
$results = $wpdb->get_results($query);

The patched version uses sanitize_text_field() to strip malicious input and $wpdb->prepare() to safely bind the parameter, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site running Relevanssi < 4.26.0 or Relevanssi Premium < 2.29.0.
• A user account with Contributor role or higher.

Exploitation Steps:

1. Log in to WordPress with the Contributor account.
2. Navigate to the search functionality (e.g., /wp-admin/admin-ajax.php or a custom search page).
3. Intercept the search request using a proxy like Burp Suite.
4. Modify the search parameter to include a SQL injection payload. Example:

   s=test' UNION SELECT user_login,user_pass FROM wp_users--
   

5. Submit the request. The injected SQL will be executed, potentially returning user credentials.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual SQL errors in WordPress debug logs.
2. Look for search queries containing SQL keywords (UNION, SELECT, DROP, etc.).
3. Check for unexpected database queries from the Relevanssi plugin.
4. Review user activity logs for Contributor accounts performing abnormal search operations.

Hunting Queries:

• Search for HTTP requests to /wp-admin/admin-ajax.php with parameters containing SQL syntax.
• Monitor database query logs for LIKE clauses with injected SQL.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with search parameters containing SQL keywords (e.g., UNION, SELECT, DROP).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• Host IOCs:

  • WordPress debug log entries showing SQL errors from the Relevanssi plugin.
  • Unexpected database entries or modifications (e.g., new admin users, altered content).
  • Presence of webshells or backdoor files in the WordPress installation.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/relevanssi/.
  • Suspicious entries in .htaccess or wp-config.php.

Detection Engineering

YARA Rule

rule CVE_2025_14719_Relevanssi_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Relevanssi WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14719"
    strings:
        $s1 = "relevanssi" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "DROP" nocase
        $s5 = "wp_users" nocase
    condition:
        all of ($s1, $s2, $s3) or all of ($s1, $s4, $s5)
}

Sigma Rule

title: CVE-2025-14719 Relevanssi SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Relevanssi WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 's='
            - 'relevanssi'
        cs-uri-query|re: '(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)'
    condition: selection
falsepositives:
    - Legitimate search queries containing SQL keywords
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14719 Relevanssi SQL Injection Attempt"; flow:to_server,established; content:"relevanssi"; nocase; http_uri; pcre:"/(UNION|SELECT|DROP|INSERT|UPDATE|DELETE|--|#)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Upgrade Relevanssi to version 4.26.0 or later, and Relevanssi Premium to version 2.29.0 or later.
2. Disable the plugin: If immediate update is not possible, disable the Relevanssi plugin until patched.
3. Review user roles: Temporarily restrict Contributor and higher roles from using search functionality if possible.

Long-term Mitigations:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection attempts.
2. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
3. Least Privilege: Ensure database user accounts used by WordPress have minimal necessary privileges.
4. Regular Audits: Conduct regular security audits of all WordPress plugins and themes.
5. Monitoring: Enable detailed logging and monitoring for database queries and authentication attempts.

Patch Details: Upgrade to Relevanssi 4.26.0 or Relevanssi Premium 2.29.0. These versions include proper input sanitization and parameterized queries.

Valters IT
Securing Digital Frontiers