CVE-2025-24659: WPDM Premium Packages SQLi Vulnerability

CVE-2025-24659 Overview

CVE-2025-24659 is a blind SQL injection vulnerability in the Shahjada WPDM – Premium Packages plugin for WordPress. The flaw affects all plugin versions up to and including 5.9.6. It stems from improper neutralization of special elements used in SQL commands [CWE-89]. An authenticated attacker with high privileges can inject malicious SQL through vulnerable plugin parameters. Successful exploitation can disclose sensitive database contents and impact resources beyond the plugin's security scope due to the changed scope rating. The vulnerability carries a CVSS 3.1 base score of 7.6 and an EPSS probability of 2.157% (84.6 percentile).

Critical Impact
Authenticated attackers can perform blind SQL injection against the WordPress database, exposing sensitive data and crossing trust boundaries to affect resources beyond the plugin.

Affected Products

WPDM – Premium Packages (wpdm-premium-packages) plugin for WordPress
All versions up to and including 5.9.6
WordPress sites using the Premium Packages add-on for selling digital products

Discovery Timeline

2025-01-24 - CVE-2025-24659 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24659

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. The WPDM – Premium Packages plugin accepts attacker-controlled input and incorporates it into SQL queries without adequate sanitization or parameterization. Because the injection is blind, attackers infer database contents through boolean-based or time-based responses rather than direct output. The vulnerability requires authentication with high privileges but does not require user interaction. The scope change indicates that exploitation impacts resources managed outside the vulnerable component's security authority, such as the broader WordPress database.

Root Cause

The root cause is the plugin's failure to properly sanitize or parameterize user-supplied input before concatenating it into SQL queries. WordPress provides the $wpdb->prepare() API for safe query construction, but the plugin does not consistently apply it to all input paths. Unsanitized parameters reach the database layer as raw SQL fragments.

Attack Vector

The attack is delivered over the network against a vulnerable WordPress installation. An authenticated user with elevated privileges submits crafted parameters to a plugin endpoint that processes SQL operations. The attacker uses conditional payloads (for example, AND SLEEP(5) or AND 1=1) to extract data one bit at a time by observing response timing or content differences. Because the injection is blind, automated tools such as sqlmap are typically used to enumerate tables and exfiltrate values including user credentials and session tokens.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-24659

Indicators of Compromise

Unusual SQL syntax tokens such as UNION SELECT, SLEEP(, BENCHMARK(, or -- in HTTP query strings and POST bodies targeting wpdm-premium-packages endpoints.
Repeated authenticated requests from a single session with incrementally varying parameter values, characteristic of blind SQLi enumeration.
Spikes in slow database queries originating from plugin handlers, indicating time-based blind injection.
Web server log entries showing high-privilege accounts accessing plugin admin actions from unfamiliar IP addresses.

Detection Strategies

Deploy a WordPress-aware web application firewall with rules tuned to detect SQL injection patterns in plugin parameters.
Enable MySQL general query logging or slow query logging temporarily on suspected hosts to capture injected payloads.
Correlate authenticated WordPress sessions with database error rates and query latency anomalies.
Review WordPress audit logs for privileged account activity that touches the WPDM plugin outside expected workflows.

Monitoring Recommendations

Monitor administrator and editor account logins for anomalous source IPs, geographies, or session durations.
Alert on HTTP 500 responses returned from plugin endpoints, which often accompany failed injection attempts.
Track outbound network connections from the web server to detect post-exploitation data exfiltration.
Continuously inventory installed plugins and their versions to identify hosts still running WPDM – Premium Packages <= 5.9.6.

How to Mitigate CVE-2025-24659

Immediate Actions Required

Identify all WordPress sites running the WPDM – Premium Packages plugin and verify installed versions.
Update the plugin to a version newer than 5.9.6 as soon as a patched release is available from the vendor.
Rotate credentials for any high-privilege WordPress accounts that may have been compromised.
Audit the wp_users, wp_usermeta, and any custom WPDM tables for unauthorized modifications.

Patch Information

The vulnerability affects WPDM – Premium Packages versions up to and including 5.9.6. Administrators should consult the Patchstack Vulnerability Advisory for the latest fixed version information and apply the vendor's patched release through the WordPress plugin updater.

Workarounds

Restrict access to WordPress administrative endpoints using IP allowlists at the web server or WAF layer.
Enforce multi-factor authentication for all administrator, editor, and shop manager accounts to raise the bar for the high-privilege precondition.
Temporarily deactivate the WPDM – Premium Packages plugin on internet-exposed sites until a patched version is installed.
Apply virtual patching rules in a WAF to block SQL injection payloads targeting plugin parameters.

bash

# Example WAF rule (ModSecurity) to block common SQLi patterns on WPDM endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/wpdm-premium-packages/" \
  "id:1009001,phase:2,deny,status:403,\
   chain,msg:'Potential SQLi against WPDM Premium Packages (CVE-2025-24659)'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--\s|;\s*drop\s)" \
    "t:none,t:urlDecodeUni"