CVE-2025-23967: GG Bought Together WooCommerce SQL Injection

CVE-2025-23967 Overview

CVE-2025-23967 is an SQL Injection vulnerability affecting the GG Bought Together for WooCommerce WordPress plugin developed by wpopal. This vulnerability allows unauthenticated attackers to inject malicious SQL commands through improperly neutralized user input, potentially leading to unauthorized database access, data exfiltration, and system compromise. The vulnerability stems from a failure to properly sanitize special elements used in SQL commands (CWE-89).

Critical Impact

This SQL Injection vulnerability enables unauthenticated remote attackers to manipulate database queries, potentially exposing sensitive customer data, order information, and WordPress credentials stored in the database.

Affected Products

• GG Bought Together for WooCommerce versions through 1.0.2
• WordPress installations running vulnerable plugin versions
• WooCommerce stores utilizing the affected plugin

Discovery Timeline

• 2025-06-27 - CVE-2025-23967 published to NVD
• 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2025-23967

Vulnerability Analysis

This SQL Injection vulnerability exists in the GG Bought Together for WooCommerce plugin, a WordPress extension designed to display "frequently bought together" product recommendations in WooCommerce stores. The vulnerability allows attackers to inject arbitrary SQL commands through network-accessible endpoints without requiring authentication.

The attack can be executed remotely with no user interaction required, and successful exploitation could affect resources beyond the vulnerable component's security scope. An attacker exploiting this vulnerability could extract sensitive data from the WordPress database, including customer personally identifiable information (PII), payment details, order history, and administrative credentials.

The impact extends primarily to confidentiality with potential for high data exposure, though availability may also be affected through database manipulation or denial-of-service attacks targeting database resources.

Root Cause

The root cause of CVE-2025-23967 lies in improper input validation and sanitization within the plugin's database query handling. The plugin fails to properly escape or parameterize user-supplied input before incorporating it into SQL queries, allowing attackers to break out of the intended query structure and execute arbitrary SQL commands.

WordPress provides built-in functions such as $wpdb->prepare() for safe query parameterization, but the vulnerable code paths in GG Bought Together for WooCommerce neglect to implement these protective measures, directly concatenating user input into database queries.

Attack Vector

The vulnerability is exploitable via network-based attacks targeting WordPress installations running the affected plugin. Attackers can craft malicious HTTP requests containing SQL injection payloads directed at vulnerable plugin endpoints.

The attack requires no authentication or user privileges, making it accessible to any remote attacker who can reach the WordPress installation. No user interaction is required, meaning the attack can be fully automated.

Successful exploitation typically follows this pattern: the attacker identifies a vulnerable endpoint in the plugin that accepts user input, crafts a payload containing SQL syntax designed to manipulate the database query, and submits the malicious request. The unsanitized input is processed and executed against the database, returning unauthorized data or modifying database contents.

For detailed technical analysis and proof-of-concept information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-23967

Indicators of Compromise

• Unusual database query patterns in WordPress/MySQL logs containing SQL syntax characters like single quotes, UNION SELECT statements, or comment sequences (--, /*)
• HTTP access logs showing requests to GG Bought Together plugin endpoints with encoded SQL payloads in parameters
• Unexpected database read operations or data exports occurring outside normal application behavior
• Error messages in application logs indicating SQL syntax errors or database connection anomalies

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns including UNION-based, boolean-based, and time-based injection techniques
• Implement database activity monitoring to alert on anomalous query patterns, especially those involving sensitive tables like wp_users or wp_options
• Configure WordPress security plugins to monitor for suspicious parameter values in requests to WooCommerce-related endpoints
• Enable detailed MySQL query logging and establish baselines to identify deviation from normal query behavior

Monitoring Recommendations

• Monitor HTTP requests to WordPress installations for SQL injection attack signatures in URL parameters and POST bodies
• Set up alerts for database queries containing suspicious keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, or DROP from unexpected sources
• Review WordPress plugin directories for the presence of gg-bought-together and cross-reference with installed version numbers
• Implement real-time log analysis for WordPress and MySQL logs to detect exploitation attempts promptly

How to Mitigate CVE-2025-23967

Immediate Actions Required

• Audit all WordPress installations to identify instances of GG Bought Together for WooCommerce plugin version 1.0.2 or earlier
• Disable or deactivate the vulnerable plugin until a patched version is available and verified
• Implement Web Application Firewall rules to block SQL injection attempts targeting WordPress and WooCommerce endpoints
• Review database access logs for signs of prior exploitation and investigate any anomalies
• Consider database credential rotation if exploitation is suspected

Patch Information

Currently, affected versions include all releases from the initial version through 1.0.2. Check the Patchstack Vulnerability Report and the WordPress plugin repository for updated versions that address this vulnerability. Before updating, ensure you have a complete backup of your WordPress installation and database.

Workarounds

• Temporarily deactivate the GG Bought Together for WooCommerce plugin through the WordPress admin dashboard until a security patch is released
• Implement strict input validation at the web server or reverse proxy level using ModSecurity or similar WAF solutions with OWASP Core Rule Set
• Restrict network access to WordPress administrative interfaces and WooCommerce API endpoints using IP allowlisting where feasible
• Enable WordPress database query logging and establish monitoring alerts for suspicious activity patterns

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate gg-bought-together --path=/var/www/html/wordpress

# Verify plugin status after deactivation
wp plugin status gg-bought-together --path=/var/www/html/wordpress

# Search for vulnerable plugin across multiple WordPress installations
find /var/www -name "gg-bought-together" -type d 2>/dev/null