CVE-2025-22505: NC Wishlist for WooCommerce SQLi Flaw

CVE-2025-22505 Overview

CVE-2025-22505 is a SQL Injection vulnerability in the Crispweb NC Wishlist for WooCommerce WordPress plugin. The flaw affects all versions up to and including 1.0.1. Authenticated attackers with low privileges can inject malicious SQL statements through unsanitized input parameters. The vulnerability is classified under [CWE-89] for improper neutralization of special elements used in an SQL command. Exploitation occurs over the network without user interaction and impacts the confidentiality of the underlying database.

Critical Impact

Authenticated attackers can extract sensitive data from the WordPress database, including customer information, credentials, and order history stored by WooCommerce.

Affected Products

• Crispweb NC Wishlist for WooCommerce plugin versions through 1.0.1
• WordPress sites running the nc-wishlist-for-woocommerce plugin
• WooCommerce installations integrating the affected wishlist component

Discovery Timeline

• 2025-01-09 - CVE-2025-22505 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22505

Vulnerability Analysis

The NC Wishlist for WooCommerce plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. Attackers can craft requests containing SQL metacharacters that alter query logic. The scope is marked as changed, meaning successful exploitation can affect resources beyond the vulnerable component. The flaw enables data exfiltration from the WordPress database backend.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The plugin concatenates untrusted input directly into SQL queries without using prepared statements or the WordPress $wpdb->prepare() API. WordPress provides parameterized query mechanisms, but the affected code paths bypass these safeguards. This allows attacker-controlled values to be interpreted as SQL syntax rather than data.

Attack Vector

Exploitation requires network access and a low-privilege authenticated session on the target WordPress site. Attackers submit specially crafted parameters to vulnerable plugin endpoints. The malicious payload modifies the structure of backend SQL queries to extract arbitrary database content. Common exploitation techniques include union-based extraction, boolean-based blind injection, and time-based blind injection. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-22505

Indicators of Compromise

• Unusual SQL syntax in web server access logs targeting nc-wishlist-for-woocommerce plugin endpoints
• Database error messages referencing malformed queries from wishlist-related requests
• Unexpected outbound data transfers following authenticated user sessions interacting with the plugin
• Anomalous query patterns including UNION SELECT, SLEEP(), or BENCHMARK() calls in MySQL slow logs

Detection Strategies

• Review WordPress and web server logs for requests containing SQL metacharacters such as single quotes, comments, and union keywords targeting the wishlist plugin
• Deploy a Web Application Firewall (WAF) with SQL injection signature detection for WordPress plugin endpoints
• Enable MySQL general query logging temporarily to identify queries containing attacker-controlled syntax

Monitoring Recommendations

• Monitor for low-privilege accounts issuing high volumes of requests to plugin AJAX or REST endpoints
• Alert on database response time anomalies that may indicate time-based blind SQL injection
• Track newly created or modified WordPress user accounts following suspicious plugin activity

How to Mitigate CVE-2025-22505

Immediate Actions Required

• Identify all WordPress installations running NC Wishlist for WooCommerce version 1.0.1 or earlier
• Disable the nc-wishlist-for-woocommerce plugin until a patched version is installed
• Rotate WordPress administrator credentials and database passwords if compromise is suspected
• Audit user accounts and database tables for unauthorized modifications

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Affected versions include all releases up to and including 1.0.1. Site administrators should consult the Patchstack Vulnerability Report for current remediation guidance and patch availability.

Workarounds

• Remove or deactivate the vulnerable plugin until an upstream fix is available
• Restrict access to WordPress authenticated endpoints via IP allowlisting where feasible
• Deploy WAF rules blocking SQL injection patterns on URLs containing nc-wishlist
• Apply the principle of least privilege to WordPress database user accounts, limiting access to only required tables