CVE-2025-10142: PagBank WooCommerce Plugin SQLi Vulnerability

CVE-2025-10142 Overview

CVE-2025-10142 is a SQL Injection vulnerability [CWE-89] in the PagBank / PagSeguro Connect para WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 4.44.3. The status parameter is not sufficiently escaped, and the surrounding SQL query lacks proper preparation. Authenticated users with Shop Manager-level access or above can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. The vulnerability was addressed by the plugin author in a subsequent release that introduced $wpdb->prepare() calls around user-controlled parameters.

Critical Impact
Authenticated Shop Managers can execute arbitrary SQL queries against the WordPress database, exposing customer records, order data, and credentials stored in wp_options or related tables.

Affected Products

PagBank / PagSeguro Connect para WooCommerce plugin versions ≤ 4.44.3
WordPress sites running the WooCommerce integration with the vulnerable plugin
E-commerce stores exposing Shop Manager or Administrator accounts to untrusted users

Discovery Timeline

2025-09-10 - CVE-2025-10142 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10142

Vulnerability Analysis

The vulnerability resides in the subscription listing logic of the PagBank Connect plugin, specifically in src/Connect/Recurring/Admin/Subscriptions/SubscriptionList.php. The code reads the status value from $_REQUEST['status'], applies sanitize_text_field(), and then concatenates the result directly into a SQL WHERE clause. While sanitize_text_field() strips tags and normalizes whitespace, it does not escape SQL metacharacters such as single quotes. An authenticated attacker with Shop Manager privileges can inject a payload that closes the string literal and appends a UNION SELECT or subquery to exfiltrate data from other tables. The same pattern affected the order_id parameter and query construction in RecurringDashboard.php, where placeholders were built dynamically without a subsequent prepare() call.

Root Cause

The root cause is direct string concatenation of user-controlled input into a SQL statement without parameterized queries. WordPress provides $wpdb->prepare() specifically for this purpose, and the pre-patch code omitted it.

Attack Vector

An attacker with Shop Manager access sends a crafted HTTP request to the subscriptions admin page with a malicious status query parameter. The injected SQL executes with the database privileges of the WordPress installation, enabling extraction of user hashes, session tokens, and PII.

php

         $orderby = wp_unslash($orderby);
         $order = (isset($_GET['order']) && in_array($_GET['order'], array('asc', 'desc'))) ? $_GET['order'] : 'desc'; //phpcs:ignore WordPress.Security.NonceVerification
 
+        global $wpdb;
         $where = "1=1";
         if (!empty($_REQUEST['status'])) {
             $status = sanitize_text_field(wp_unslash($_REQUEST['status']));
-            $where .= " AND status = '$status'";
+            $where .= $wpdb->prepare(" AND status = %s", $status);
         }
         if (!empty($_REQUEST['order_id'])) {
             $order_id = intval($_REQUEST['order_id']);
-            $where .= " AND initial_order_id = $order_id";
+            $where .= $wpdb->prepare(" AND initial_order_id = %d", $order_id);
         }

Source: GitHub commit a9c3352. The patch introduces $wpdb->prepare() with typed placeholders (%s, %d) to safely bind user input.

Detection Methods for CVE-2025-10142

Indicators of Compromise

Unexpected SQL syntax such as UNION, SLEEP(, INFORMATION_SCHEMA, or single quotes in the status or order_id query parameters of the /wp-admin/ subscriptions page.
Database error messages in PHP logs referencing the plugin's subscription list queries.
Anomalous outbound data transfers from the web server following Shop Manager logins.

Detection Strategies

Inspect web server access logs for requests to plugin admin endpoints containing URL-encoded SQL metacharacters in the status parameter.
Enable WordPress SAVEQUERIES in staging environments to identify unprepared statements referencing the pagbank_recurring table.
Deploy a Web Application Firewall (WAF) rule that blocks non-alphanumeric characters in the status parameter for the PagBank admin routes.

Monitoring Recommendations

Alert on Shop Manager or Administrator account activity that includes queries to non-plugin tables such as wp_users or wp_usermeta.
Monitor for the creation of new administrator accounts or password resets shortly after suspicious admin requests.
Correlate authentication logs with plugin admin page access to identify credential compromise of privileged e-commerce accounts.

How to Mitigate CVE-2025-10142

Immediate Actions Required

Update the PagBank / PagSeguro Connect para WooCommerce plugin to a version later than 4.44.3 that includes the parameterized query fix.
Audit all Shop Manager and Administrator accounts and remove any that are unnecessary or inactive.
Rotate credentials for privileged WordPress accounts and enforce multi-factor authentication.

Patch Information

The vendor addressed the vulnerability in commit a9c3352, published through the WordPress plugin changeset. The fix replaces direct string concatenation with $wpdb->prepare() using %s and %d placeholders. Additional details are available in the Wordfence vulnerability report and the PagBank Connect plugin page.

Workarounds

Restrict access to /wp-admin/ using IP allow-listing at the web server or firewall until the patch is applied.
Deploy a WAF signature that blocks SQL metacharacters in the status and order_id request parameters.
Temporarily disable the plugin if updates cannot be applied in the near term and Shop Manager accounts are exposed to untrusted users.

bash

# Example nginx location block restricting plugin admin access by IP
location ~* /wp-admin/admin\.php {
    allow 203.0.113.0/24;
    deny all;
}