CVE-2025-12850: WordPress My Auctions Allegro SQLi Flaw

CVE-2025-12850 Overview

CVE-2025-12850 is an unauthenticated SQL injection vulnerability in the My Auctions Allegro plugin for WordPress. The flaw affects all versions up to and including 3.6.32. Attackers can manipulate the auction_id parameter to inject arbitrary SQL into existing database queries. The plugin fails to escape user input and does not use prepared statements for the affected query. Unauthenticated remote attackers can append SQL clauses to extract sensitive data from the WordPress database, including user credentials and configuration values. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated attackers can extract sensitive database contents from any WordPress site running My Auctions Allegro 3.6.32 or earlier through a single HTTP request.

Affected Products

• My Auctions Allegro plugin for WordPress (free edition)
• All plugin versions up to and including 3.6.32
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2025-12-05 - CVE-2025-12850 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12850

Vulnerability Analysis

The My Auctions Allegro plugin processes the auction_id parameter without proper sanitization. The plugin concatenates the user-supplied value directly into an SQL query string. The query does not use the WordPress $wpdb->prepare() method to bind parameters safely. Attackers exploit this by submitting crafted values that close the original query context and append additional SQL statements. Because the request requires no authentication and no user interaction, exploitation is trivial against exposed installations.

Successful exploitation results in confidentiality loss. The vulnerability does not directly modify data or affect availability, but extracted credentials can enable follow-on account takeover and lateral movement within WordPress administration.

Root Cause

The root cause is insufficient input neutralization combined with the absence of prepared statements. The plugin code reads auction_id from the request and inserts the raw value into a SELECT statement. WordPress provides esc_sql() and $wpdb->prepare() for safe query construction, but the vulnerable code path uses neither. The fix landed in the plugin repository as WordPress Plugin Changeset 3402268.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to a vulnerable endpoint with a malicious auction_id value. Typical payloads use UNION SELECT clauses to merge attacker-controlled result sets into the original query response. Time-based or boolean-based blind injection techniques work when the response does not echo query results directly.

The vulnerability is documented in the Wordfence Vulnerability Report, which details the affected parameter and the absence of preparation logic.

Detection Methods for CVE-2025-12850

Indicators of Compromise

• HTTP requests containing SQL syntax in the auction_id parameter, such as UNION, SELECT, SLEEP(, or -- comment sequences
• Unusual database query latency correlated with requests targeting auction-related endpoints
• Web server access logs showing repeated requests with varying auction_id values from a single source
• Unexpected outbound data volume from the WordPress host following crafted auction requests

Detection Strategies

• Inspect web server logs for requests to plugin endpoints containing URL-encoded SQL metacharacters like %27, %20UNION, or %20OR%201=1
• Deploy a web application firewall rule that blocks SQL keywords in the auction_id query parameter
• Compare installed plugin versions against 3.6.32 and flag any version at or below that release
• Monitor MySQL slow query logs for queries referencing the auction table with unusual WHERE clauses

Monitoring Recommendations

• Enable WordPress audit logging to record administrator account changes and password resets
• Forward web server and database logs to a centralized analytics platform for correlation
• Alert on HTTP 500 responses from auction plugin endpoints, which often indicate failed injection attempts
• Track the WordPress wp_users and wp_options tables for unauthorized read access patterns

How to Mitigate CVE-2025-12850

Immediate Actions Required

• Update the My Auctions Allegro plugin to the version released after 3.6.32 immediately
• Deactivate the plugin on any site where an updated version is not yet available
• Rotate WordPress administrator passwords and any database credentials accessible to the site
• Review user accounts for unauthorized additions or privilege changes

Patch Information

The vendor addressed the vulnerability in the changeset published at WordPress Plugin Changeset 3402268. The fix adds proper escaping and uses prepared statements for the auction_id parameter. Site administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin files directly.

Workarounds

• Block requests containing SQL metacharacters in the auction_id parameter at the WAF or reverse proxy layer
• Restrict access to auction plugin endpoints by IP address until the patch is applied
• Disable the plugin entirely if patching is not feasible in the short term
• Apply database user privilege restrictions so the WordPress account cannot read sensitive tables outside its scope

# Example WAF rule (ModSecurity) blocking SQLi patterns in auction_id
SecRule ARGS:auction_id "@rx (?i)(union(\s|\+)+select|sleep\(|benchmark\(|--|/\*)" \
    "id:1009850,phase:2,deny,status:403,msg:'CVE-2025-12850 SQLi attempt blocked'"