CVE-2025-8994

Executive Summary

CVE-2025-8994 is a time-based blind SQL Injection vulnerability in the WordPress plugin WP Project Manager (versions up to and including 2.6.26). The flaw resides in the completed_at_operator parameter, which is insufficiently sanitized and prepared before being used in SQL queries. An authenticated attacker with Subscriber-level access or higher can exploit this to extract sensitive data from the database, such as user credentials, session tokens, and other confidential information. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for affected WordPress sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Users should treat this as a supply chain risk, as the plugin is widely used for project management and team collaboration. The lack of a patch from the vendor (Wedevs) means that site administrators must implement compensating controls or consider removing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs Subscriber-level access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (6.5). While the impact on confidentiality is high, the requirement for authentication and the lack of public exploits reduce the immediate threat. However, the absence of a patch makes it a persistent risk.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection in the completed_at_operator parameter. The plugin’s code likely constructs SQL queries by directly concatenating user input without proper parameterization or escaping. The completed_at_operator parameter is used to filter tasks based on completion date, and the attacker can inject SQL commands that cause time delays (e.g., SLEEP(5)) to infer database information character by character.

Root Cause: Insufficient input validation and lack of prepared statements. The plugin uses esc_sql() or similar functions incorrectly, or fails to use $wpdb->prepare() for the parameter.

Attack Flow:

1. Attacker authenticates with Subscriber-level credentials.
2. Attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-json/wp-project-manager/v2/tasks) with a malicious completed_at_operator value.
3. The injected SQL causes a time delay, allowing the attacker to extract data via boolean-based or time-based inference.
4. Sensitive data (e.g., wp_users table) is exfiltrated.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

$operator = $_GET['completed_at_operator'];
$query = "SELECT * FROM tasks WHERE completed_at $operator NOW()";
$results = $wpdb->get_results($query);

Patched Code (Conceptual):

$allowed_operators = array('>', '<', '=');
$operator = $_GET['completed_at_operator'];
if (in_array($operator, $allowed_operators)) {
    $query = $wpdb->prepare("SELECT * FROM tasks WHERE completed_at $operator %s", $date);
    $results = $wpdb->get_results($query);
}

The patched version uses a whitelist of allowed operators and parameterized queries to prevent injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Project Manager <= 2.6.26.
• Subscriber-level account credentials.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-json/wp-project-manager/v2/tasks).
2. Craft a request with a malicious completed_at_operator parameter:

   GET /wp-json/wp-project-manager/v2/tasks?completed_at_operator=>' OR SLEEP(5)-- HTTP/1.1
   Host: target.com
   Cookie: wordpress_logged_in_...
   

3. Observe the response time. If it takes ~5 seconds, the injection is successful.
4. Use a tool like sqlmap to automate data extraction:

   sqlmap -u "http://target.com/wp-json/wp-project-manager/v2/tasks?completed_at_operator=*" --cookie="wordpress_logged_in_..." --batch --time-sec=5 --dbs
   

Note: No public exploit code is available, so this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual response times in API endpoints related to WP Project Manager.
• Look for SQL injection patterns in completed_at_operator parameter (e.g., SLEEP, BENCHMARK, OR 1=1).
• Use WAF rules to block suspicious SQL keywords.

Hunting:

• Search logs for requests to /wp-json/wp-project-manager/v2/tasks with non-standard completed_at_operator values.
• Correlate with authentication logs to identify Subscriber-level accounts making such requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-json/wp-project-manager/v2/tasks with completed_at_operator containing SQL keywords (e.g., SLEEP, BENCHMARK, OR).
  • Response times exceeding normal thresholds (e.g., > 2 seconds) for API calls.
• Host IOCs:
  • Unusual database queries in MySQL logs (e.g., SELECT * FROM tasks WHERE completed_at > ' OR SLEEP(5)--).
  • Presence of sqlmap or similar tools on the attacker’s machine (not on the server).
• File IOCs:
  • Modified plugin files (if attacker uploads a webshell), but this is not the primary vector.

Detection Engineering

YARA Rule

rule CVE_2025_8994_WP_Project_Manager_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WP Project Manager completed_at_operator parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8994"
    strings:
        $sqli1 = "completed_at_operator" nocase
        $sqli2 = "SLEEP" nocase
        $sqli3 = "BENCHMARK" nocase
        $sqli4 = "OR " nocase
        $sqli5 = "AND " nocase
    condition:
        $sqli1 and any of ($sqli2, $sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: CVE-2025-8994 WP Project Manager SQL Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects time-based SQL injection attempts against WP Project Manager plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'completed_at_operator'
        cs-uri-query|contains|all:
            - 'SLEEP'
            - 'BENCHMARK'
            - 'OR '
            - 'AND '
    condition: selection
falsepositives:
    - Legitimate use of operators with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8994 WP Project Manager SQL Injection Attempt"; flow:to_server,established; content:"completed_at_operator"; http_uri; pcre:"/(SLEEP|BENCHMARK|OR\s+\d|AND\s+\d)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Implement a Web Application Firewall (WAF) rule to block requests containing SQL keywords in the completed_at_operator parameter.
3. Restrict API access to authenticated users with higher privileges (e.g., Editor or Admin) if possible.

Long-term Fix:

• Monitor the vendor’s repository for a patched version (>= 2.6.27).
• If no patch is released, consider migrating to an alternative project management plugin.
• Apply virtual patching via WAF or custom code to whitelist allowed operators.

Compensating Controls:

• Use a database activity monitoring (DAM) solution to detect anomalous queries.
• Enable detailed logging for WordPress REST API endpoints.

Valters IT