CVE-2024-12025: Collapsing Categories SQL Injection Flaw

CVE-2024-12025 Overview

CVE-2024-12025 is a SQL injection vulnerability in the Collapsing Categories plugin for WordPress affecting all versions up to and including 3.0.8. The flaw resides in the taxonomy parameter of the /wp-json/collapsing-categories/v1/get REST API endpoint. Insufficient escaping of user input combined with improper SQL query preparation allows unauthenticated attackers to append arbitrary SQL statements to existing queries. Successful exploitation enables extraction of sensitive information from the underlying WordPress database, including user credentials, session tokens, and configuration secrets.

Critical Impact
Unauthenticated remote attackers can exfiltrate database contents from any WordPress site running the Collapsing Categories plugin version 3.0.8 or earlier via a single crafted REST API request.

Affected Products

Collapsing Categories WordPress plugin versions up to and including 3.0.8
WordPress installations exposing the /wp-json/collapsing-categories/v1/get REST route
Any WordPress site with the plugin activated, regardless of authentication state

Discovery Timeline

2024-12-18 - CVE-2024-12025 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12025

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89] and is reachable over the network without authentication or user interaction. The Collapsing Categories plugin registers a REST API route at /wp-json/collapsing-categories/v1/get that accepts a taxonomy parameter from the HTTP request. The parameter value flows into a SQL query without prepared statements or proper escaping. Attackers can append a UNION SELECT payload or stacked subquery to retrieve arbitrary data from any table accessible to the WordPress database user. The EPSS score of 2.54% places this vulnerability in the 82nd percentile for exploitation likelihood, reflecting the low attack complexity and public availability of the affected endpoint.

Root Cause

The root cause is the absence of parameterized queries when handling the taxonomy REST parameter. WordPress provides the $wpdb->prepare() API to bind user input safely, but the affected code path concatenates the parameter directly into the SQL string. No input validation restricts the parameter to known taxonomy names, and no escaping is applied via esc_sql() or equivalent functions.

Attack Vector

An attacker sends an HTTP GET request to the vulnerable REST endpoint with a malicious taxonomy value. Because the route is registered without an authentication callback, no login is required. The injected SQL executes within the WordPress database context and returns query results in the HTTP response, enabling direct data exfiltration. Refer to the Wordfence Vulnerability Report for the detailed payload structure and the WordPress Plugin Changeset for the corrective code commit.

Detection Methods for CVE-2024-12025

Indicators of Compromise

HTTP requests to /wp-json/collapsing-categories/v1/get containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the taxonomy parameter
Unusual outbound database query patterns originating from the wp-json REST handler in PHP-FPM or web server logs
Spikes in 200-status responses to the affected REST route from a single source IP within a short timeframe

Detection Strategies

Inspect web access logs for requests to the collapsing-categories/v1/get endpoint with suspicious URL-encoded characters such as %27, %20OR%20, or -- in query parameters
Deploy a Web Application Firewall (WAF) ruleset that flags SQL metacharacters within WordPress REST API parameters
Correlate WordPress database error log entries with REST API request timestamps to identify failed injection attempts

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a centralized SIEM for query parameter analysis
Monitor database query duration and result-set size for anomalous reads against wp_users, wp_usermeta, and wp_options tables
Alert on any unauthenticated HTTP request to plugin REST routes that includes non-alphanumeric characters in taxonomy-style parameters

How to Mitigate CVE-2024-12025

Immediate Actions Required

Update the Collapsing Categories plugin to a version newer than 3.0.8 as published in the WordPress Plugin Changeset
Audit WordPress access logs for requests to /wp-json/collapsing-categories/v1/get since December 2024
Rotate WordPress administrator credentials, secret keys in wp-config.php, and any API tokens stored in the database if compromise is suspected

Patch Information

The plugin maintainer addressed the vulnerability in the changeset referenced by the WordPress plugin repository. The fix introduces prepared statements via $wpdb->prepare() and validates the taxonomy parameter against known taxonomy values. Site operators should upgrade through the WordPress admin dashboard or by deploying the patched plugin archive directly.

Workarounds

Deactivate and remove the Collapsing Categories plugin until the patched version is installed
Block external access to /wp-json/collapsing-categories/v1/get at the web server or WAF layer using a deny rule
Restrict REST API access to authenticated users by applying a rest_authentication_errors filter that rejects anonymous requests to plugin namespaces

bash

# Nginx rule to block the vulnerable REST endpoint until patched
location ~* /wp-json/collapsing-categories/v1/get {
    deny all;
    return 403;
}