CVE-2025-9199

Executive Summary

CVE-2025-9199 is a critical SQL Injection vulnerability discovered in the Woo Superb Slideshow Transition Gallery with Random Effect plugin for WordPress. The flaw resides in the woo-superb-slideshow shortcode, which fails to properly escape user-supplied parameters and lacks sufficient preparation of SQL queries. This allows authenticated attackers with at least Contributor-level access to inject arbitrary SQL commands into existing queries, potentially leading to the extraction of sensitive data from the WordPress database, such as user credentials, session tokens, and private content.

As a WordPress plugin vulnerability, this issue is entirely within the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The plugin is used to create dynamic slideshow galleries, and the vulnerable shortcode is commonly embedded in posts, pages, or widgets. Given the low EPSS score (0.0%), active exploitation in the wild is currently unlikely, but the risk remains significant for sites with untrusted contributors.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. There is no associated NPM, PyPI, Go, or Ruby package. The supply chain risk is limited to the plugin’s update mechanism; however, since no patch is available, site administrators must manually disable or remove the plugin to mitigate risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the shortcode is processed normally.
• Privileges Required (PR): Low (L) – An attacker needs Contributor-level access or higher.
• User Interaction (UI): None (N) – No user action is needed beyond the attacker’s own actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Successful exploitation can lead to full database disclosure.
• Integrity (I): None (N) – No data modification is possible via this vector.
• Availability (A): None (N) – No denial-of-service impact.

Overall CVSS Score: 6.5 (Medium)
Threat Level: Moderate – While the CVSS score is medium, the potential for data exfiltration makes this a serious concern for affected sites.

Deep Dive & Mechanics

The vulnerability exists in the woo-superb-slideshow shortcode handler. The plugin retrieves a user-supplied parameter (likely id or category) and directly concatenates it into an SQL query without proper sanitization or parameterized queries. For example:

$slideshow_id = $_GET['id'];
$query = "SELECT * FROM wp_slideshows WHERE id = $slideshow_id";

Because the input is not escaped, an attacker can inject SQL syntax such as ' OR '1'='1 or UNION SELECT ... to manipulate the query. The lack of prepared statements (e.g., using $wpdb->prepare()) is the root cause.

The attack vector is the WordPress shortcode, which can be embedded in posts, pages, or widgets. An authenticated user with Contributor-level access can create or edit a post containing the malicious shortcode. When the post is rendered, the shortcode executes the vulnerable SQL query, allowing the attacker to extract data from the database.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 9.1):

function woo_superb_slideshow_shortcode($atts) {
    $id = $atts['id'];
    global $wpdb;
    $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}slideshows WHERE id = $id");
    // ... render slideshow
}

Patched Code (hypothetical fix):

function woo_superb_slideshow_shortcode($atts) {
    $id = intval($atts['id']); // Cast to integer
    global $wpdb;
    $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}slideshows WHERE id = %d", $id));
    // ... render slideshow
}

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to safely bind the parameter, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with the Woo Superb Slideshow plugin (version <= 9.1) installed and activated.
• An authenticated user account with Contributor-level privileges or higher.

Exploitation Steps:

1. Craft the malicious shortcode:
   Create a new post or page and insert the following shortcode:

   [woo-superb-slideshow id='1 UNION SELECT user_login,user_pass FROM wp_users']
   

2. Publish or preview the post:
   The shortcode will be processed by the server, executing the injected SQL query.

3. Extract data:
   The results of the injected query may be displayed in the slideshow output or cause an error that reveals data. For blind SQL injection, use time-based or boolean-based techniques.

Example payload for time-based injection:

[woo-superb-slideshow id='1 AND SLEEP(5)']

Note: No public exploit code is available from Exploit-DB or other sources at this time.

Blue Team (Defense & Detection)

Detection:

• Monitor WordPress logs for unusual shortcode usage, especially from Contributor-level users.
• Look for SQL error messages in server logs that contain UNION, SLEEP, or other SQL keywords.
• Use a Web Application Firewall (WAF) to block requests containing SQL injection patterns in shortcode parameters.

Hunting:

• Search the database for posts containing [woo-superb-slideshow with suspicious id values.
• Review user activity logs for posts created or edited by Contributors that include the vulnerable shortcode.

Indicators of Compromise (IOCs)

• Network: HTTP requests to WordPress sites with parameters like id=' OR '1'='1 or id=1 UNION SELECT.
• File: Presence of the plugin directory /wp-content/plugins/woo-superb-slideshow/ (version <= 9.1).
• Database: Unusual entries in the wp_posts table containing the shortcode with SQL injection patterns.
• Logs: SQL error messages in WordPress debug logs or server error logs referencing the wp_slideshows table.

Detection Engineering

YARA Rule

rule Woo_Superb_Slideshow_SQLi {
    meta:
        description = "Detects SQL injection attempts against Woo Superb Slideshow plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9199"
    strings:
        $shortcode = /\[woo-superb-slideshow[^\]]*id\s*=\s*['"][^'"]*['"]/
        $sqli_pattern = /(UNION|SELECT|SLEEP|BENCHMARK|OR\s+1=1)/i
    condition:
        $shortcode and $sqli_pattern
}

Sigma Rule

title: Woo Superb Slideshow SQL Injection Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the Woo Superb Slideshow plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '/wp-content/plugins/woo-superb-slideshow/'
        c-uri|contains|all:
            - 'id='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in non-malicious context (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9199 Woo Superb Slideshow SQL Injection Attempt"; flow:to_server,established; content:"/wp-content/plugins/woo-superb-slideshow/"; http_uri; content:"id="; http_uri; pcre:"/UNION|SELECT|SLEEP|BENCHMARK/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Woo Superb Slideshow plugin from all WordPress installations until a patch is released.
2. Review user roles: Restrict Contributor-level access to trusted users only, as this vulnerability requires authenticated access.
3. Audit existing content: Search for any posts or pages containing the [woo-superb-slideshow] shortcode and remove or sanitize them.

Long-term Fix:

• The vendor must release a patched version that uses parameterized queries (e.g., $wpdb->prepare()) and input validation (e.g., intval()).
• Until then, consider using an alternative slideshow plugin that is actively maintained and secure.

Workaround:

• Implement a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns in shortcode parameters.
• Use a security plugin like Wordfence to monitor and block malicious shortcode usage.

Valters IT