🧾 Detailed a Description

CVE-2025-10175 — Unauthorized Database Access And Data Exfiltration

• Affected Component: wplf_update_from_previous() ($wpdb->get_results("SELECT * FROM $table WHERE id = $id ..."))
• Attack Vector: Authenticated (nonce required) AJAX-based Blind SQL Injection (id parameter)
• Trigger: By sending a crafted request with a valid nonce to /wp-admin/admin-ajax.php, a time delay can be observed:

• Impact: Attackers can gradually extract database contents (user accounts, emails, configuration values) and obtain administrator password hashes, leading to privilege escalation. Disclosure of schema information and record counts weakens confidentiality and facilitates subsequent targeted attacks against the entire WordPress installation.
• PoC:

1. An authenticated user sends a POST request to /wp-admin/admin-ajax.php with a valid nonce.
2. The id parameter is injected with a time-based payload such as 1 AND SLEEP(5).
3. The server response is delayed, confirming the presence of Blind SQL Injection.

❓Reason for the vulnerability

The id parameter is taken directly from $_REQUEST and only passed through sanitize_text_field(), which does not prevent SQL injection. The value is then concatenated directly into the SQL query without prepared statements or proper parameter binding.

Proposed Fix:

Use $wpdb->prepare()

ひとこと

プラグイン自体にSQLインジェクション脆弱性があっても、WordPressのコア部分がエスケープしてしまうというケースはかなりあるが、今回はPrepareもBindも使っておらず、escシリーズも使われていなかったため、Blind SQLが可能だった。 これを期にBlind SQL構文の勉強をしたが、法律に引っかかるのが怖いので共有はしません。

🔍 Discoverer

Name: MooseLove
Role: Independent security researcher / bug hunter
Contact: Available upon request

📚 References

• Product: https://wordpress.org/plugins/wp-links-page/

⚠️ License

This advisory is provided for public security awareness. Free to share with attribution.