CVE-2025-10730: WP Tabber Widget SQL Injection Vulnerability

CVE-2025-10730 Overview

CVE-2025-10730 is a SQL Injection vulnerability affecting the WP Tabber Widget plugin for WordPress in all versions up to and including 4.0. The flaw resides in the wp-tabber-widget shortcode, which fails to properly escape user-supplied parameters and does not use prepared statements for its SQL queries. Authenticated attackers with Contributor-level access or higher can append additional SQL queries to existing ones and extract sensitive information from the WordPress database. The vulnerability is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Contributor-level users can exfiltrate confidential database contents, including user credentials, session tokens, and configuration secrets stored in WordPress tables.

Affected Products

WP Tabber Widget plugin for WordPress — all versions up to and including 4.0
WordPress sites that expose Contributor-level (or higher) registration or role assignment
WordPress installations using the plugin's shortcode functionality on public pages

Discovery Timeline

2025-10-15 - CVE-2025-10730 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10730

Vulnerability Analysis

The WP Tabber Widget plugin registers a wp-tabber-widget shortcode that accepts user-controlled attributes and uses them within a SQL query without adequate sanitization. Because the input is concatenated into the query string and the plugin does not rely on $wpdb->prepare() with parameter binding, an attacker can break out of the intended query context and append additional statements or UNION-based payloads.

Exploitation requires authentication at the Contributor role or above. Contributors can insert shortcodes into posts and drafts, giving them a direct path to trigger the vulnerable database call. The impact is confidentiality-focused: the attacker can read arbitrary rows from tables such as wp_users and wp_usermeta, exposing password hashes, session tokens, and other secrets stored in wp_options.

Root Cause

The root cause is insufficient input escaping combined with a missing use of parameterized queries. The shortcode handler passes attacker-controlled shortcode attributes into a dynamically constructed SQL statement executed by the WordPress database abstraction layer. See the WordPress Plugin Code Review at line 51 for the vulnerable code path.

Attack Vector

An authenticated Contributor crafts a post or page containing the wp-tabber-widget shortcode with a malicious attribute value. When the shortcode is rendered, the injected SQL is appended to the plugin's query and executed by the database. Additional technical detail is available in the Wordfence Vulnerability Report.

// No verified proof-of-concept code is published for this CVE.
// Refer to the WordPress plugin source and Wordfence advisory for details.

Detection Methods for CVE-2025-10730

Indicators of Compromise

Post or draft content containing [wp-tabber-widget] shortcodes with unusual attribute values such as UNION SELECT, SLEEP(, or encoded SQL keywords
Unexpected outbound queries against wp_users, wp_usermeta, or wp_options originating from front-end page renders
Database error entries in PHP or web server logs referencing the plugin file wp-tabber-widget.php

Detection Strategies

Review WordPress audit logs for Contributor accounts creating or editing posts that embed the wp-tabber-widget shortcode
Deploy a web application firewall (WAF) rule that inspects shortcode attribute values for SQL metacharacters and common injection payloads
Enable MySQL general query logging in staging environments to identify malformed or chained SQL statements produced by the plugin

Monitoring Recommendations

Alert on new user registrations that immediately obtain Contributor or higher privileges
Monitor database read volume from the web front-end and flag spikes correlated with shortcode-heavy page loads
Track file integrity of wp-content/plugins/wp-tabber-widget/ to detect tampering or attacker-supplied variants

How to Mitigate CVE-2025-10730

Immediate Actions Required

Disable or uninstall the WP Tabber Widget plugin until a vendor-supplied patch is available and verified
Audit all Contributor, Author, Editor, and Administrator accounts and remove untrusted or dormant users
Review recent posts and drafts for suspicious wp-tabber-widget shortcode usage and remove offending content

Patch Information

No fixed version is listed in the enriched CVE data at the time of publication. The vulnerability affects all releases up to and including 4.0. Consult the Wordfence Vulnerability Report for the latest patch status and vendor updates.

Workarounds

Restrict shortcode usage by removing or overriding the wp-tabber-widget shortcode registration via a mu-plugin using remove_shortcode('wp-tabber-widget')
Downgrade untrusted accounts from Contributor to Subscriber to eliminate the ability to author shortcode content
Deploy WAF signatures that block SQL injection patterns in POST bodies submitted to /wp-admin/post.php and /wp-admin/post-new.php

bash

# Configuration example: disable the vulnerable shortcode via a mu-plugin
# File: wp-content/mu-plugins/disable-wp-tabber-widget.php
<?php
add_action('init', function () {
    if (shortcode_exists('wp-tabber-widget')) {
        remove_shortcode('wp-tabber-widget');
    }
}, 100);