CVE-2025-25151: Stylemix uListing SQLi Vulnerability

CVE-2025-25151 Overview

CVE-2025-25151 is a SQL Injection vulnerability affecting the Stylemix uListing plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It impacts all uListing versions from n/a through 2.1.6.

Authenticated attackers with low privileges can inject crafted SQL statements through vulnerable plugin parameters. Successful exploitation enables database content extraction and limited tampering of backend data. The scope is marked as changed, meaning the impact can extend beyond the vulnerable component into the underlying WordPress database.

Critical Impact
A low-privileged authenticated attacker can execute arbitrary SQL queries against the WordPress database, leading to exposure of sensitive listing, user, and configuration data stored by the uListing plugin.

Affected Products

Stylemix uListing WordPress plugin versions through 2.1.6
WordPress sites running the ulisting plugin
Any uListing deployment that has not applied a vendor-supplied fix

Discovery Timeline

2025-02-07 - CVE-2025-25151 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25151

Vulnerability Analysis

The vulnerability resides in the uListing plugin's handling of user-supplied input passed into SQL queries. The plugin fails to properly sanitize or parameterize input before concatenating it into database statements. As a result, attacker-controlled data is interpreted as SQL syntax rather than as literal values.

Exploitation requires authentication, but the privilege threshold is low. This significantly broadens the pool of potential attackers on WordPress sites that allow user registration or operate marketplaces where customers and vendors hold accounts. Once exploited, the attacker gains the ability to read arbitrary database rows and modify a subset of records through UNION-based or stacked queries supported by the WordPress database driver.

The CWE-89 classification confirms the root cause as Improper Neutralization of Special Elements used in an SQL Command. The Patchstack advisory details the affected parameter and confirms the upper bound of 2.1.6 for affected releases.

Root Cause

The root cause is the direct inclusion of untrusted input into SQL queries without prepared statements or input escaping. WordPress provides the $wpdb->prepare() API for parameterized queries, but the affected uListing code paths bypass this safeguard. Special characters such as single quotes and SQL keywords reach the database engine intact.

Attack Vector

The attack vector is network-based and requires only low privileges with no user interaction. An attacker authenticates to the WordPress site as a low-privileged user, then issues a crafted HTTP request to the vulnerable uListing endpoint. The malicious payload is embedded in a parameter that the plugin uses to construct a SQL query.

For technical details and proof-of-concept information, refer to the Patchstack SQL Injection Vulnerability advisory.

Detection Methods for CVE-2025-25151

Indicators of Compromise

HTTP requests to uListing plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or INFORMATION_SCHEMA
Unexpected database errors logged by WordPress or MySQL referencing uListing query paths
Authenticated POST or GET requests from low-privileged accounts targeting uListing AJAX or REST endpoints with unusually long parameter values
Outbound data exfiltration patterns correlated with requests to the ulisting plugin

Detection Strategies

Inspect web server access logs for requests targeting ulisting endpoints that include SQL syntax tokens in query strings or POST bodies
Enable MySQL general query logging temporarily in non-production environments to identify malformed or suspicious queries originating from the plugin
Deploy a Web Application Firewall (WAF) with WordPress-aware SQL injection rules and monitor blocked requests targeting the ulisting plugin path

Monitoring Recommendations

Alert on authentication events from low-privileged accounts followed by bursts of requests to plugin endpoints
Monitor for new or modified WordPress user accounts with elevated capabilities, which may indicate post-exploitation activity
Track database read volumes from the WordPress application user to detect bulk extraction of wp_users, wp_usermeta, or uListing tables

How to Mitigate CVE-2025-25151

Immediate Actions Required

Upgrade the uListing plugin to a version newer than 2.1.6 once the vendor publishes a patched release
Audit existing WordPress user accounts and revoke unnecessary low-privilege registrations on sites running uListing
Review database access logs and WordPress audit trails for indicators of prior exploitation
Rotate WordPress secret keys, administrator passwords, and any credentials stored in the affected database

Patch Information

At the time of publication, the vulnerability affects uListing through version 2.1.6. Site administrators should monitor the Patchstack advisory and the official Stylemix uListing changelog for a fixed release and apply it without delay.

Workarounds

Deploy a WordPress-aware WAF with virtual patching rules covering CVE-2025-25151 until an official fix is installed
Restrict access to uListing administrative and AJAX endpoints by IP address where operationally feasible
Temporarily disable the uListing plugin on sites where listing functionality is not business-critical
Limit new user registration or require manual approval to reduce the population of low-privileged accounts capable of exploitation

bash

# Example: temporarily disable the uListing plugin via WP-CLI
wp plugin deactivate ulisting

# Verify the plugin status
wp plugin status ulisting