PagSeguro-Connect-Para-WooCommerce-CVE-Report

Disclosure for CVE-2025-10142

CVE-2025-10142 - Vulnerability in PagSeguro-Connect-para-WooCommerce

This repository discloses a vulnerability discovered in PagSeguro-Connect-para-WooCommerce <= 4.44.3,WordPress plugin developed by Ricardo Martins.

🛠 Affected Version

• Product: PagSeguro-Connect-para-WooCommerce
• Version: v4.44.3
• URL: https://wordpress.org/plugins/pagbank-connect/

🔒 Assigned CVE

🧾 Detailed a Description

CVE-2025-10142 — Unauthorized Database Access And Data Exfiltration

• Affected Component: rm-pagbank-subscriptions admin page
• Attack Vector: Authenticated (Shop Manager or Administrator) via GET request
• Trigger: By injecting malicious SQL into the status parameter, an attacker can extract sensitive data from the database via UNION-based SQL injection.

GET /wp-admin/admin.php?page=rm-pagbank-subscriptions&status=' UNION SELECT CAST(version() AS CHAR),2,3,4,5,6,7,8,9,10,11,12,13,14,15 -- -

• Impact: Injected SQL is executed and the results are rendered in the HTML table in the admin page. Examples of extractable data include:
  • version() → Database version
  • user() → MySQL user
  • database() → Database name
  • SELECT user_login, user_pass FROM wp_users (hashed admin credentials)
  • Any data from wp_options, wp_usermeta, etc.

❓Reason for the vulnerability

The status parameter is directly concatenated into a SQL query without escaping or using $wpdb->prepare()

if (!empty($_REQUEST['status'])) {
           $status = sanitize_text_field(wp_unslash($_REQUEST['status']));
           $where .= " AND status = '$status'";
       }

$this->items = $wpdb->get_results(
           $wpdb->prepare(
               "SELECT * FROM {$wpdb->prefix}pagbank_recurring WHERE $where ORDER BY  $orderby $order LIMIT %d OFFSET %d",
               $per_page,
               ($current_page - 1) * $per_page
           ),
           ARRAY_A
       );
...

ひとこと

ShopManagerから攻撃可能であるため、脅威はかなり低い。 外部入力を$whereに入れ、その$whereをそのままSQL構文に仕込むという処理を追うのが少し大変だった。

🔍 Discoverer

Name: MooseLove
Role: Independent security researcher / bug hunter
Contact: Available upon request

📚 References

• Product: https://wordpress.org/plugins/pagbank-connect/

⚠️ License

This advisory is provided for public security awareness. Free to share with attribution.