CVE-2025-24672 Overview
CVE-2025-24672 is a SQL Injection vulnerability affecting the codepeople Form Builder CP plugin (cp-easy-form-builder) for WordPress. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. Attackers with low-privilege authenticated access can inject malicious SQL statements through vulnerable plugin parameters. The vulnerability affects all versions of Form Builder CP up to and including 1.2.41. Successful exploitation allows attackers to read sensitive database contents and impact system availability. The scope is changed, meaning the compromise can extend beyond the vulnerable component to affect other resources.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, personal data, and form submissions stored by the plugin.
Affected Products
- codepeople Form Builder CP (cp-easy-form-builder) WordPress plugin
- All versions from initial release through 1.2.41
- WordPress installations using the vulnerable plugin
Discovery Timeline
- 2025-01-24 - CVE-2025-24672 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24672
Vulnerability Analysis
The vulnerability resides in the Form Builder CP plugin's handling of user-supplied input passed to SQL queries. The plugin fails to properly sanitize or parameterize inputs before concatenating them into database queries. This allows an authenticated attacker with low privileges to inject arbitrary SQL syntax. The changed scope indicates that exploitation can affect data outside the vulnerable component's security boundary, such as other WordPress tables or shared database resources. Confidentiality impact is high because attackers can extract complete database contents. Availability impact is low but present, as malicious queries can degrade database performance or corrupt plugin-managed tables.
Root Cause
The root cause is improper neutralization of special SQL elements [CWE-89] in one or more plugin endpoints. The plugin concatenates untrusted input directly into SQL statements without using prepared statements or the WordPress $wpdb->prepare() API. Any special characters such as single quotes, comment delimiters, or UNION keywords pass through unmodified.
Attack Vector
Exploitation requires network access and authenticated credentials with low privileges, such as a subscriber or contributor role. No user interaction is needed. The attacker submits crafted input to a vulnerable plugin parameter, which is then executed as part of a SQL query. See the Patchstack advisory for technical details on the vulnerable parameter and request structure.
No public proof-of-concept exploit code has been verified at this time. The vulnerability mechanism follows the standard WordPress plugin SQL injection pattern where user input reaches $wpdb->query() or $wpdb->get_results() without proper preparation.
Detection Methods for CVE-2025-24672
Indicators of Compromise
- Unusual POST or GET requests to Form Builder CP endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
- Unexpected outbound queries or long-running database processes originating from PHP worker processes
- New or modified administrator accounts in wp_users without corresponding audit trail entries
- Web server access logs showing encoded SQL payloads (%27, %20UNION%20) targeting plugin URLs
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting /wp-content/plugins/cp-easy-form-builder/ request paths
- Enable MySQL general query logging temporarily to identify anomalous queries referencing WordPress tables from plugin contexts
- Correlate authenticated low-privilege user sessions with database read volume spikes
- Review WordPress plugin version inventories to identify installations running 1.2.41 or earlier
Monitoring Recommendations
- Alert on HTTP responses containing SQL error strings such as You have an error in your SQL syntax returned from plugin endpoints
- Monitor for time-based blind SQL injection indicators, including consistent request latency above baseline for plugin URLs
- Track authentication events followed immediately by high-volume database queries from the same session
How to Mitigate CVE-2025-24672
Immediate Actions Required
- Identify all WordPress instances running Form Builder CP version 1.2.41 or earlier through plugin inventory scans
- Restrict plugin access to trusted authenticated users only until a patched version is deployed
- Deploy WAF signatures blocking SQL injection payloads directed at cp-easy-form-builder endpoints
- Rotate WordPress administrator credentials and database passwords if exploitation is suspected
Patch Information
At the time of publication, review the Patchstack advisory for the latest patched version guidance from codepeople. Upgrade to any release later than 1.2.41 once available and verified by the vendor.
Workarounds
- Disable the Form Builder CP plugin until a patched release is installed
- Apply virtual patching through a WAF using generic SQL injection rules mapped to the plugin's request paths
- Restrict database user privileges for the WordPress connection account to the minimum required, reducing lateral impact from injection
- Enforce least-privilege role assignments so untrusted users cannot reach authenticated plugin functionality
# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate cp-easy-form-builder
wp plugin status cp-easy-form-builder
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
