CVE-2018-25434: WP AutoSuggest SQL Injection Vulnerability

CVE-2018-25434 Overview

CVE-2018-25434 is an SQL injection vulnerability in the WordPress plugin WP AutoSuggest version 0.24. Unauthenticated attackers can send crafted GET requests to autosuggest.php containing malicious payloads in the wpas_keys parameter. The plugin passes this input directly into a database query without sanitization, allowing arbitrary SQL execution against the WordPress database. Attackers can extract WordPress post content, user credentials, session tokens, and other sensitive records stored in backend tables. The flaw maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command. WP AutoSuggest has been closed on the WordPress plugin directory, so administrators must remove it manually.

Critical Impact

Unauthenticated SQL injection allows full read access to the WordPress database, including user credentials and session data.

Affected Products

• WP AutoSuggest WordPress plugin, version 0.24
• WordPress installations that have the WP AutoSuggest plugin installed and activated
• Sites exposing autosuggest.php through the plugin directory

Discovery Timeline

• 2026-06-01 - CVE-2018-25434 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2018-25434

Vulnerability Analysis

The vulnerability resides in autosuggest.php, the endpoint that powers the plugin's autocomplete feature. The script accepts the wpas_keys parameter from GET requests and concatenates it into an SQL statement targeting the wp_posts table. No prepared statements, parameter binding, or input escaping is performed before the query reaches the database layer.

Because the endpoint does not require authentication, any remote visitor can reach the injection point. Attackers commonly use UNION-based payloads to merge data from wp_users, wp_usermeta, or wp_options into the autosuggest response. Time-based and boolean-based blind techniques also work when the response body is filtered.

The issue is classified under CWE-89. Successful exploitation does not require user interaction and can be fully automated using tools such as sqlmap.

Root Cause

The root cause is the direct interpolation of user-controlled input into a dynamic SQL string. The developer relied on the parameter being treated as a search term without applying esc_sql(), $wpdb->prepare(), or equivalent sanitization. WordPress provides these APIs specifically to neutralize SQL metacharacters, but the plugin bypasses them.

Attack Vector

The attack is purely network-based and unauthenticated. An attacker issues a GET request to https://target/wp-content/plugins/wp-autosuggest/autosuggest.php?wpas_keys=<payload>. The payload contains SQL metacharacters such as ', UNION SELECT, or SLEEP() functions. The plugin returns query output directly in the HTTP response, simplifying data exfiltration. Refer to the Exploit-DB #45977 entry and the VulnCheck SQL Injection Advisory for proof-of-concept request structures.

Detection Methods for CVE-2018-25434

Indicators of Compromise

• GET requests to /wp-content/plugins/wp-autosuggest/autosuggest.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or INFORMATION_SCHEMA in the wpas_keys parameter.
• URL-encoded SQL metacharacters (%27, %20OR%20, %23) within wpas_keys values.
• High-volume requests to autosuggest.php from a single source address indicative of automated tools like sqlmap.
• Database error messages or extended response times correlated with autosuggest.php requests in web server logs.

Detection Strategies

• Inspect WordPress and web server access logs for requests matching the autosuggest.php URI pattern combined with SQL syntax in query strings.
• Deploy web application firewall (WAF) rules that match SQL injection signatures against the wpas_keys parameter specifically.
• Correlate database slow query logs with HTTP requests to the plugin endpoint to identify blind, time-based exploitation.

Monitoring Recommendations

• Enable verbose access logging on wp-content/plugins/wp-autosuggest/ and forward logs to a centralized SIEM for query-string analysis.
• Alert on responses to autosuggest.php that contain user table column names such as user_login, user_pass, or user_email.
• Track outbound data volumes from the WordPress host to identify bulk database exfiltration following injection attempts.

How to Mitigate CVE-2018-25434

Immediate Actions Required

• Deactivate and delete the WP AutoSuggest plugin from all WordPress installations, since version 0.24 is the latest release and no patched version exists.
• Block external access to wp-content/plugins/wp-autosuggest/autosuggest.php at the web server or WAF until the plugin is removed.
• Rotate WordPress administrator credentials, API keys, and session secrets if exploitation indicators are present in logs.
• Audit the wp_users and wp_options tables for unauthorized accounts or modified configuration values.

Patch Information

No official patch is available. The plugin is no longer maintained and has been removed from the official directory referenced in the WordPress Plugin Documentation. Administrators must migrate to an actively maintained autocomplete plugin or implement search suggestions through a vetted alternative.

Workarounds

• Deny HTTP requests to autosuggest.php using web server rules (Deny from all in Apache or return 403 in nginx) until the plugin is uninstalled.
• Apply a generic SQL injection WAF ruleset, such as the OWASP Core Rule Set, with paranoia level tuned to inspect query parameters.
• Restrict database user privileges so the WordPress account cannot read sensitive tables outside the WordPress schema.

# nginx configuration to block the vulnerable endpoint
location ~* /wp-content/plugins/wp-autosuggest/autosuggest\.php$ {
    deny all;
    return 403;
}