CVE-2025-13000: Db-access WordPress Plugin SQLi Vulnerability

CVE-2025-13000 Overview

CVE-2025-13000 is a SQL injection vulnerability in the db-access WordPress plugin through version 0.8.7. The plugin fails to enforce authorization checks on an AJAX action handler. Any authenticated user, including low-privileged subscriber accounts, can invoke the action and inject arbitrary SQL into database queries. The flaw is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Successful exploitation exposes sensitive database contents, including WordPress user records and password hashes. The vulnerability was published by WPScan.

Critical Impact
Any authenticated WordPress user, including subscribers, can extract arbitrary data from the WordPress database through a missing-authorization SQL injection in an AJAX endpoint.

Affected Products

jimbob1953 db-access WordPress plugin versions through 0.8.7
WordPress sites that allow open user registration (subscriber role)
Any WordPress installation with the db-access plugin enabled

Discovery Timeline

2025-12-02 - CVE-2025-13000 published to NVD
2026-01-30 - Last updated in NVD database

Technical Details for CVE-2025-13000

Vulnerability Analysis

The db-access plugin registers an AJAX action that is reachable through the standard WordPress admin-ajax.php endpoint. The handler does not verify the capability of the calling user before constructing and executing a SQL statement. WordPress treats any authenticated session, including the default subscriber role, as eligible to invoke wp_ajax_* actions. The handler also fails to parameterize input passed into the query. An attacker supplies crafted values that break out of the intended query context and append attacker-controlled SQL. This combination of missing authorization and missing input neutralization classifies the issue as [CWE-89].

Root Cause

The root cause is twofold. First, the AJAX action lacks a current_user_can() capability check or a privileged nonce gate. Second, user-supplied parameters are concatenated into SQL strings without using $wpdb->prepare() or equivalent parameterized query primitives. WordPress only separates wp_ajax_nopriv_* from wp_ajax_* by authentication state, not by role, so subscriber-level sessions inherit access to every privileged AJAX action that does not perform its own authorization.

Attack Vector

Exploitation requires only an authenticated WordPress account on the target site. An attacker registers as a subscriber where open registration is enabled, authenticates, and issues a POST request to /wp-admin/admin-ajax.php with the vulnerable action parameter and crafted SQL payloads in the injectable field. Because the CVSS scope is changed and confidentiality impact is high, query results can expose data outside the plugin's intended access boundary, such as wp_users rows and option values containing API keys. No verified public exploit code is available; consult the WPScan Vulnerability Advisory for technical specifics.

Detection Methods for CVE-2025-13000

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php from subscriber accounts containing SQL meta-characters such as UNION, SELECT, SLEEP(, 0x, or stacked semicolons in parameter values.
Unusual spikes in admin-ajax.php traffic tied to the db-access plugin action name.
New subscriber registrations followed within minutes by repeated AJAX calls and outbound data transfer.
Database error entries in debug.log or PHP error logs referencing the plugin's query functions.

Detection Strategies

Inspect web server access logs for authenticated POST requests to admin-ajax.php carrying SQL syntax in request bodies.
Deploy a Web Application Firewall (WAF) rule set that flags SQLi signatures against admin-ajax.php regardless of authentication state.
Correlate WordPress audit logs of subscriber logins with subsequent AJAX activity to identify low-privilege accounts probing privileged endpoints.

Monitoring Recommendations

Forward WordPress, PHP, and reverse proxy logs to a centralized analytics platform and alert on SQL error strings tied to plugin file paths.
Monitor outbound data volumes from the web tier and database tier for anomalies that indicate bulk extraction.
Track installed plugin inventories across managed WordPress fleets and flag any host running db-access at version 0.8.7 or earlier.

How to Mitigate CVE-2025-13000

Immediate Actions Required

Disable or uninstall the db-access plugin until a fixed release is published by the vendor.
Disable open user registration on public WordPress sites, or set the default new-user role to a custom role with no capabilities.
Rotate WordPress administrator passwords and any API secrets stored in wp_options if exploitation is suspected.
Audit the wp_users table for unexpected accounts and elevated capabilities.

Patch Information

No fixed version is listed in the advisory. All releases through 0.8.7 are affected. Track the WPScan Vulnerability Advisory for an upstream patch from the jimbob1953 maintainer. Until a patched build is available, removal is the only complete remediation.

Workarounds

Block unauthenticated and subscriber-level access to the affected AJAX action at the WAF or reverse proxy by matching the action parameter and rejecting the request.
Restrict /wp-admin/admin-ajax.php to authenticated requests with capabilities above subscriber where business logic permits.
Apply virtual patching rules in a WAF to drop POST bodies containing SQL keywords destined for the plugin's action.

bash

# Example nginx rule to block the vulnerable AJAX action entirely
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^db_access_") {
        return 403;
    }
    if ($request_body ~* "action=db_access_") {
        return 403;
    }
}