CVE-2025-24659

Executive Summary

CVE-2025-24659 is a critical Blind SQL Injection vulnerability discovered in the WordPress plugin WPDM – Premium Packages (slug: wpdm-premium-packages), developed by Shahjada. The vulnerability resides in the improper neutralization of special elements used in an SQL command. An unauthenticated attacker can exploit this flaw to perform blind SQL injection attacks, potentially extracting sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information.

The vulnerability affects all versions of the plugin from n/a through 5.9.6. As of this report, no official patch has been released, and the vendor's patch status is unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the risk remains high due to the potential impact and the widespread use of WordPress.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users who have installed the plugin from any source are at risk. Since the plugin is not an NPM, PyPI, Go, or Ruby package, standard supply chain security measures for those ecosystems do not apply. However, administrators should verify the integrity of their plugin installations and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, leading to full database compromise. Given the low attack complexity and no required privileges, this is a high-priority threat for all WordPress sites using the affected plugin.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection flaw in the wpdm-premium-packages plugin. The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. Specifically, the blind SQL injection occurs in a parameter that is passed directly to a database query without proper escaping or parameterization.

Blind SQL Injection means the attacker does not receive direct error messages or data output from the database. Instead, they infer information based on the application's response (e.g., time delays or boolean responses). This makes exploitation more complex but still feasible with automated tools like sqlmap.

The vulnerable code likely resides in a function that handles user input for package searches, downloads, or other premium features. The attacker can inject SQL commands by manipulating HTTP request parameters (GET or POST) that are not properly validated.

Example vulnerable code snippet (hypothetical):

$package_id = $_GET['pid'];
$query = "SELECT * FROM wp_posts WHERE ID = $package_id";
$result = $wpdb->get_results($query);

In this example, the $package_id variable is directly concatenated into the SQL query without any sanitization, allowing an attacker to inject SQL commands.

Vulnerable vs. Patched Code

Since no official patch is available, we can only hypothesize what a patched version would look like. The fix would involve using prepared statements or parameterized queries.

Vulnerable Code (hypothetical):

$id = $_GET['id'];
$sql = "SELECT * FROM wp_downloads WHERE id = $id";
$results = $wpdb->get_results($sql);

Patched Code (hypothetical):

$id = intval($_GET['id']);
$sql = $wpdb->prepare("SELECT * FROM wp_downloads WHERE id = %d", $id);
$results = $wpdb->get_results($sql);

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to safely bind the parameter, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with WPDM – Premium Packages version <= 5.9.6 installed and activated.
• Knowledge of the vulnerable parameter (e.g., pid, id, download_id).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy (e.g., Burp Suite) to intercept requests from the plugin. Look for parameters that are passed to database queries.

2. Test for SQL injection: Inject a single quote (') into the parameter and observe the response. If an error or different behavior occurs, the parameter is likely vulnerable.

3. Exploit using sqlmap:

   sqlmap -u "http://target.com/wp-content/plugins/wpdm-premium-packages/some-file.php?pid=1" --batch --dbs
   

4. Extract data: Once the injection is confirmed, extract database names, tables, and sensitive data such as wp_users table.

Example manual payload (time-based blind):

http://target.com/wp-content/plugins/wpdm-premium-packages/some-file.php?pid=1 AND IF(1=1,SLEEP(5),0)

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual SQL-like patterns in request parameters (e.g., ', OR, AND, SLEEP, UNION).
• Use WAF rules to block common SQL injection patterns.
• Implement database query logging to detect anomalous queries.

Defense:

• Immediately disable or remove the vulnerable plugin until a patch is available.
• Apply virtual patching via WAF (e.g., ModSecurity rules).
• Restrict database user privileges to limit the impact of a successful injection.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing SQL injection patterns in parameters (e.g., ' OR '1'='1, SLEEP(5), UNION SELECT).
  • Unusual response times indicating time-based blind injection attempts.

• File IOCs:

  • Modified plugin files (e.g., wpdm-premium-packages/ directory) with suspicious code.
  • Unexpected database entries or new admin users.

• Log IOCs:

  • Web server logs showing repeated requests to plugin endpoints with SQL-like payloads.
  • Database logs showing queries with unexpected syntax.

Detection Engineering

YARA Rule

rule CVE_2025_24659_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting WPDM Premium Packages plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24659"
    strings:
        $sqli1 = /[?&](pid|id|download_id)=.*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
        $sqli2 = /['\"]\s*(OR|AND)\s+['\"]\s*['\"]\s*=\s*['\"]/i
        $sqli3 = /SLEEP\(\d+\)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-24659 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against WPDM Premium Packages plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24659
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "' OR '1'='1"
            - "SLEEP("
            - "UNION SELECT"
            - "BENCHMARK("
    condition: selection
falsepositives:
    - Legitimate use of special characters in search queries
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24659 SQL Injection Attempt"; flow:to_server,established; content:"/wp-content/plugins/wpdm-premium-packages/"; http_uri; pcre:"/(\?|&)(pid|id|download_id)=.*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and uninstall wpdm-premium-packages until a patch is released.
2. Apply virtual patching: Use a Web Application Firewall (WAF) to block SQL injection patterns targeting the plugin.
3. Review database logs: Check for any signs of unauthorized data access or modification.

Long-term Fix:

• Monitor the plugin's official page for a security update. Once a patched version is released (e.g., > 5.9.6), update immediately.
• If the plugin is no longer maintained, consider replacing it with an alternative solution.

General Best Practices:

• Always use prepared statements or parameterized queries in WordPress plugin development.
• Regularly update all plugins and themes.
• Implement least privilege for database users.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert