CVE-2025-12411 Overview
CVE-2025-12411 is a SQL Injection vulnerability [CWE-89] affecting the Premmerce Wholesale Pricing for WooCommerce plugin for WordPress in versions up to and including 1.1.10. The flaw resides in the handling of the ID parameter, where user-supplied input is not properly escaped and the existing SQL query lacks sufficient preparation. Authenticated attackers with subscriber-level access or higher can manipulate SQL queries to extract sensitive database information. The price_type parameter of the premmerce_delete_price_type action is also vulnerable. Attackers can additionally modify price type display names through the admin-post.phppremmerce_update_price_type action, causing cosmetic corruption of the WordPress admin interface.
Critical Impact
Authenticated subscribers can exfiltrate sensitive data from the WordPress database and tamper with administrative display values through unsanitized SQL parameters.
Affected Products
- Premmerce Wholesale Pricing for WooCommerce plugin for WordPress
- All versions up to and including 1.1.10
- WordPress sites running WooCommerce with the affected plugin enabled
Discovery Timeline
- 2025-11-18 - CVE-2025-12411 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12411
Vulnerability Analysis
The vulnerability is a classic in-band SQL Injection rooted in two distinct entry points within the plugin's administrative action handlers. The premmerce_update_price_type action accepts an ID parameter that is concatenated into a SQL statement without parameter binding or proper sanitization. The premmerce_delete_price_type action exposes the same weakness through its price_type parameter. Because both actions are reachable via admin-post.php and require only subscriber-level authentication, the attack surface is broad on sites that allow open user registration. Successful exploitation enables data extraction from the WordPress database, including potentially sensitive content stored in WooCommerce and user tables. Beyond confidentiality impact, attackers can write attacker-controlled values into price type display name fields, leading to integrity-level corruption of the admin interface.
Root Cause
The root cause is insufficient escaping of user-supplied parameters combined with unprepared SQL statements in the affected handlers. The plugin source code at src/Admin/Admin.php line 83 and src/Models/Model.php line 171 shows direct interpolation of request parameters into SQL queries rather than using $wpdb->prepare() with placeholder binding. Review the WordPress Plugin Admin Code and WordPress Plugin Model Code for the unsafe constructs.
Attack Vector
An authenticated attacker with at least subscriber privileges sends a crafted POST request to admin-post.php invoking either the premmerce_update_price_type or premmerce_delete_price_type action. By appending SQL syntax to the ID or price_type parameter, the attacker forces the database to execute additional clauses. The vulnerability requires no user interaction. See the Wordfence Vulnerability Analysis for additional exploitation context. No verified public proof-of-concept code is available at this time.
Detection Methods for CVE-2025-12411
Indicators of Compromise
- POST requests to /wp-admin/admin-post.php with action=premmerce_update_price_type or action=premmerce_delete_price_type containing SQL metacharacters such as ', UNION, SELECT, or -- in the ID or price_type parameters
- Unexpected modifications to price type display names visible in the WooCommerce admin interface
- Web server access logs showing subscriber-level user agents repeatedly hitting the affected admin-post endpoints
- Database query logs containing malformed or unusually long SQL statements originating from the plugin's handlers
Detection Strategies
- Deploy web application firewall rules that inspect POST bodies for SQL injection payloads targeting the ID and price_type parameters of the vulnerable actions
- Enable MySQL general query logging or slow query logging temporarily to capture anomalous query patterns from the plugin
- Audit recently created WordPress accounts at subscriber level or higher for unusual activity against admin-post.php
Monitoring Recommendations
- Monitor authentication events for newly registered subscriber accounts followed by immediate access to admin-post.php
- Alert on database error responses returned to authenticated user sessions, which often indicate SQL injection probing
- Track outbound database content sizes from WordPress hosts to detect bulk data extraction attempts
How to Mitigate CVE-2025-12411
Immediate Actions Required
- Update the Premmerce Wholesale Pricing for WooCommerce plugin to a version newer than 1.1.10 as soon as a patched release is available from the vendor
- Disable or remove the plugin until a fixed version is installed if the wholesale pricing functionality is not business-critical
- Disable open user registration on the WordPress site to prevent attackers from acquiring the subscriber-level access required for exploitation
- Rotate WordPress administrative credentials and review all subscriber-and-above accounts for legitimacy
Patch Information
The vendor addressed the vulnerability in WordPress Changeset #3465244. Site administrators should upgrade to the version containing this changeset. Refer to the Wordfence Vulnerability Analysis for the fixed version reference.
Workarounds
- Restrict access to /wp-admin/admin-post.php at the web server or WAF layer to authenticated administrators only, blocking subscriber-level access to the vulnerable actions
- Apply WAF signatures that reject SQL syntax in the ID and price_type parameters when the request targets premmerce_update_price_type or premmerce_delete_price_type
- Enforce least-privilege principles by removing unnecessary subscriber accounts and disabling self-service registration in Settings > General
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
