CVE-2025-27281: All In Menu Plugin SQLi Vulnerability

CVE-2025-27281 Overview

CVE-2025-27281 is a blind SQL injection vulnerability in the cookforweb All In Menu WordPress plugin (all-in-menu). The flaw affects all plugin versions up to and including 1.1.5. Attackers with low-privilege authenticated access can inject malicious SQL statements through unsanitized input parameters. The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Because the injection is blind, attackers infer data by observing application behavior rather than direct output.

Critical Impact
Authenticated attackers can extract sensitive database contents, including user credentials and session data, from WordPress sites running vulnerable versions of the All In Menu plugin.

Affected Products

cookforweb All In Menu WordPress plugin versions through 1.1.5
WordPress installations with the all-in-menu plugin enabled
Sites permitting low-privilege authenticated user access

Discovery Timeline

2025-03-15 - CVE-2025-27281 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-27281

Vulnerability Analysis

The vulnerability stems from improper neutralization of special characters in SQL commands within the All In Menu plugin. User-supplied input reaches database query construction without adequate parameterization or escaping. An attacker submits crafted payloads that alter the intended SQL logic. Because the application does not return query results directly to the requester, exploitation relies on blind injection techniques. Attackers use boolean-based or time-based payloads to infer database content one bit at a time.

The scope is changed (S:C), meaning successful exploitation can affect resources beyond the vulnerable component. Confidentiality impact is high, while integrity and availability impacts are limited. The vulnerability requires low privileges, making it exploitable by any authenticated WordPress user with access to affected plugin functionality.

Root Cause

The plugin constructs SQL queries by concatenating user-controlled input directly into query strings. WordPress provides $wpdb->prepare() for safe parameterized queries, but the vulnerable code paths bypass this safeguard. The absence of input validation and prepared statements allows attacker-controlled values to be interpreted as SQL syntax rather than data.

Attack Vector

The attack vector is network-based with low attack complexity. An authenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint. The payload contains SQL metacharacters and conditional logic. The plugin executes the modified query against the WordPress database. The attacker observes response timing or content variations to extract data. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-27281

Indicators of Compromise

HTTP requests to All In Menu plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK
Unusually long response times on plugin AJAX or admin-ajax endpoints, indicating time-based blind injection
Database error log entries referencing malformed queries originating from the all-in-menu plugin
Unexpected authenticated sessions issuing repeated parameterized requests to menu management endpoints

Detection Strategies

Inspect web server access logs for repeated requests to all-in-menu endpoints containing encoded SQL syntax
Deploy a Web Application Firewall (WAF) with SQL injection signatures tuned for WordPress plugin parameters
Enable MySQL general query logging temporarily to identify anomalous query patterns from the WordPress user
Monitor WordPress audit logs for low-privilege accounts performing repeated plugin interactions

Monitoring Recommendations

Alert on consecutive HTTP requests to plugin endpoints with sub-second timing patterns characteristic of automated injection tooling
Baseline normal query response times and flag deviations exceeding two standard deviations
Track failed authentication followed by successful low-privilege logins as a precursor indicator
Forward WordPress and database logs to a centralized SIEM for correlation across the request lifecycle

How to Mitigate CVE-2025-27281

Immediate Actions Required

Disable the All In Menu plugin on all WordPress sites until a patched version is confirmed installed
Audit existing WordPress user accounts and remove unnecessary low-privilege accounts that could be leveraged for exploitation
Rotate WordPress administrator credentials and force password resets for all users if exploitation is suspected
Review database contents for unauthorized modifications and verify the integrity of user tables

Patch Information

No fixed version is documented in the available references for versions beyond 1.1.5. Administrators should consult the Patchstack advisory for current patch status and update the plugin as soon as a remediated release is available from cookforweb.

Workarounds

Remove or deactivate the all-in-menu plugin until a vendor patch is released
Restrict access to WordPress authenticated areas using IP allowlisting at the web server or WAF layer
Deploy WAF rules that block requests containing SQL injection signatures targeting plugin parameters
Apply the principle of least privilege by removing plugin permissions from non-administrative WordPress roles

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate all-in-menu
wp plugin delete all-in-menu