CVE-2025-47537

Executive Summary

CVE-2025-47537 is a critical SQL Injection vulnerability in the WordPress plugin "PDF Invoice Builder for WooCommerce" (slug: pdf-for-woocommerce) developed by Add-ons.org. The flaw exists in versions up to and including 5.3.8, allowing unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements. This can lead to full database compromise, including extraction of user credentials, order data, and administrative session tokens. The CVSS score of 7.6 (High) reflects the ease of exploitation (no authentication required) and the severe impact on confidentiality and integrity. No public proof-of-concept or patch is currently available, increasing the risk for unpatched installations.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin directly from the WordPress dashboard or via ZIP upload are affected. The vendor (Add-ons.org) has not released a patched version, and no commit history is available on GitHub. Organizations should treat this as a zero-day until further notice.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential to disrupt database operations.

Threat Level: Critical for unpatched WooCommerce stores. Attackers can exfiltrate customer PII, payment data, and admin credentials.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of user-supplied input within SQL queries, likely in the invoice generation or PDF download functionality. The plugin fails to escape or parameterize special characters (e.g., single quotes, double dashes) before embedding them into SQL statements. An attacker can inject malicious SQL payloads via HTTP GET/POST parameters (e.g., order_id, invoice_id, or custom query strings).

Example vulnerable code pattern (hypothetical):

$order_id = $_GET['order_id'];
$query = "SELECT * FROM wp_orders WHERE id = $order_id";
$result = $wpdb->get_results($query);

Because the input is directly concatenated, an attacker can supply 1 OR 1=1 to dump all orders, or 1 UNION SELECT user_login, user_pass FROM wp_users to extract credentials.

Vulnerable vs. Patched Code

Vulnerable (<=5.3.8):

// No sanitization or prepared statement
$invoice_id = $_REQUEST['invoice_id'];
$sql = "SELECT * FROM wp_invoices WHERE id = $invoice_id";
$results = $wpdb->get_results($sql);

Patched (hypothetical fix):

$invoice_id = intval($_REQUEST['invoice_id']); // Cast to integer
$sql = $wpdb->prepare("SELECT * FROM wp_invoices WHERE id = %d", $invoice_id);
$results = $wpdb->get_results($sql);

The patched version uses intval() to force numeric input and $wpdb->prepare() for parameterized queries, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with PDF Invoice Builder for WooCommerce <= 5.3.8.
• WooCommerce plugin active.
• Network access to the target.

Exploitation Steps:

1. Identify vulnerable endpoints (e.g., /wp-admin/admin-ajax.php?action=generate_invoice&order_id=1).
2. Inject SQL payload via the order_id parameter:

   GET /wp-admin/admin-ajax.php?action=generate_invoice&order_id=1 UNION SELECT user_login,user_pass,user_email FROM wp_users
   

3. Extract hashed passwords and crack offline (e.g., using Hashcat).
4. Escalate privileges by modifying admin email or creating a new admin user:

   GET /wp-admin/admin-ajax.php?action=generate_invoice&order_id=1; INSERT INTO wp_users (user_login,user_pass,user_email) VALUES ('hacker','$P$Bhashedpass','hacker@evil.com')
   

Note: No public exploit code is available; the above is a conceptual demonstration.

Blue Team (Defensive)

Detection & Response:

• Monitor for abnormal SQL error messages in logs (e.g., "You have an error in your SQL syntax").
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns (e.g., UNION, SELECT, OR 1=1).
• Use database activity monitoring to detect unexpected queries from the WordPress user.
• Immediately disable the plugin if no patch is available.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing SQL keywords in parameters (e.g., order_id=1 UNION SELECT).
• Logs: PHP error logs showing SQL syntax errors from wpdb::get_results.
• Database: Unexpected rows in wp_users or wp_options tables, or modified admin credentials.
• File System: Presence of webshells in /wp-content/uploads/ or plugin directories.

Detection Engineering

YARA Rule

rule CVE_2025_47537_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts targeting PDF Invoice Builder for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47537"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "wp_users" nocase
        $sqli4 = "admin-ajax.php" nocase
        $sqli5 = "generate_invoice" nocase
    condition:
        any of ($sqli*) and #sqli4 > 0 and #sqli5 > 0
}

Sigma Rule

title: SQL Injection Attempt Against PDF Invoice Builder for WooCommerce
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'UNION SELECT'
            - 'OR 1=1'
            - 'wp_users'
            - 'admin-ajax.php'
            - 'generate_invoice'
    condition: selection
falsepositives:
    - Legitimate use of UNION in custom queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47537 SQL Injection Attempt"; flow:to_server; content:"admin-ajax.php"; http_uri; content:"generate_invoice"; http_uri; pcre:"/(UNION\s+SELECT|OR\s+1=1|wp_users)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Add-ons.org.
2. Implement a WAF with custom rules to block SQL injection patterns.
3. Audit database logs for signs of compromise (unexpected queries, new admin users).
4. Change all WordPress admin passwords and force password reset for users.

Long-term Fix:

• Monitor the plugin's official page for a patched version (>=5.3.9).
• Apply the vendor's update as soon as it becomes available.
• Consider replacing the plugin with an alternative that follows secure coding practices (e.g., prepared statements).

Valters IT – Securing digital frontiers, one CVE at a time.