CVE-2025-14770: WordPress Shipping Rate By Cities SQLi

CVE-2025-14770 Overview

CVE-2025-14770 is a SQL Injection vulnerability [CWE-89] affecting the Shipping Rate By Cities plugin for WordPress. The flaw exists in all versions up to and including 2.0.0. The plugin fails to properly escape the user-supplied city parameter and does not adequately prepare the underlying SQL query. Unauthenticated attackers can append additional SQL statements to the existing query over the network. Successful exploitation allows extraction of sensitive information from the WordPress database.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials and personal data, through crafted requests to the vulnerable city parameter.

Affected Products

Shipping Rate By Cities plugin for WordPress, all versions up to and including 2.0.0
WordPress sites with the plugin installed and active
E-commerce deployments using the plugin for location-based shipping calculation

Discovery Timeline

2026-01-14 - CVE-2025-14770 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14770

Vulnerability Analysis

The vulnerability resides in the shipping rate calculation logic implemented in shiprate-cities-method-class.php. The plugin accepts a city parameter from user input and concatenates it directly into a SQL query executed against the WordPress database. The query lacks proper preparation through $wpdb->prepare() or equivalent parameterization. Attackers can inject SQL syntax that the database engine executes as part of the original statement.

Because the affected endpoint does not require authentication, exploitation requires only network access to the WordPress site. Attackers commonly leverage UNION SELECT payloads to exfiltrate data from arbitrary tables, including wp_users and wp_usermeta. The vulnerability does not directly impact integrity or availability but enables full read access to database contents.

Root Cause

The root cause is insufficient input sanitization combined with unprepared SQL query construction. The plugin treats the city parameter as trusted string input and embeds it in a query without escaping single quotes, comment sequences, or SQL keywords. WordPress provides the $wpdb->prepare() API specifically to prevent this class of flaw, but the plugin does not use it on the affected code path.

Attack Vector

An unauthenticated attacker sends an HTTP request to the WordPress site with a malicious payload in the city parameter. The payload terminates the original string context and appends an attacker-controlled SQL query. The database executes the combined statement and returns results to the application, which may reflect them in the HTTP response or be retrieved through blind techniques such as time-based or boolean-based inference.

Review the vulnerable source location in the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-14770

Indicators of Compromise

HTTP requests containing SQL metacharacters such as ', --, UNION, or SLEEP( in the city parameter
Web server access logs showing repeated requests to plugin endpoints with unusual query string lengths
Database error messages referencing syntax errors on queries originating from shiprate-cities-method-class.php
Unexpected outbound queries reading from wp_users, wp_options, or wp_usermeta tables

Detection Strategies

Deploy Web Application Firewall (WAF) rules to identify SQL Injection patterns targeting the city parameter
Enable WordPress debug logging and review PHP error logs for wpdb query failures
Correlate web access logs with database query logs to identify anomalous SELECT statements against authentication tables
Inventory WordPress installations to identify any site running the Shipping Rate By Cities plugin at version 2.0.0 or earlier

Monitoring Recommendations

Monitor for spikes in 500-series HTTP responses from plugin endpoints, which can indicate failed injection attempts
Alert on database queries returning unusually large result sets from authentication-related tables
Track new administrative user creation and password hash exports following suspicious plugin requests

How to Mitigate CVE-2025-14770

Immediate Actions Required

Deactivate and remove the Shipping Rate By Cities plugin until a patched version is confirmed available
Audit wp_users and wp_usermeta for unauthorized accounts and force a password reset for all administrators
Rotate WordPress secret keys defined in wp-config.php and any API credentials stored in the database
Apply WAF rules blocking SQL metacharacters in requests to plugin endpoints

Patch Information

No fixed version is referenced in the available advisory data at the time of publication. Site operators should monitor the Wordfence Vulnerability Report and the WordPress plugin repository for updates beyond version 2.0.0. Until a patched release is verified, removal of the plugin is the recommended path.

Workarounds

Block requests to the vulnerable plugin endpoints at the reverse proxy or WAF layer
Restrict database user privileges so the WordPress account cannot read sensitive tables beyond what is required
Place the WordPress administrative interface behind IP allowlisting to limit blast radius if credentials are exfiltrated

bash

# Example ModSecurity rule blocking SQL metacharacters in the city parameter
SecRule ARGS:city "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;)" \
    "id:1014770,phase:2,deny,status:403,log,msg:'CVE-2025-14770 SQLi attempt on city parameter'"