CVE-2025-28904: Shamalli Web Directory Free SQLi Flaw

CVE-2025-28904 Overview

CVE-2025-28904 is a critical SQL Injection vulnerability affecting the Shamalli Web Directory Free WordPress plugin through version 1.7.6. This vulnerability allows unauthenticated attackers to perform Blind SQL Injection attacks against vulnerable WordPress installations, potentially compromising database confidentiality and availability.

The vulnerability stems from improper neutralization of special elements used in SQL commands (CWE-89), allowing malicious actors to inject arbitrary SQL queries through the plugin's input handling mechanisms.

Critical Impact

Unauthenticated attackers can extract sensitive database information including user credentials, site configuration data, and other confidential information stored in the WordPress database through Blind SQL Injection techniques.

Affected Products

• Shamalli Web Directory Free plugin versions up to and including 1.7.6
• WordPress installations running vulnerable versions of the plugin
• Websites utilizing the Web Directory Free plugin for directory functionality

Discovery Timeline

• 2025-03-25 - CVE-2025-28904 published to NVD
• 2025-03-27 - Last updated in NVD database

Technical Details for CVE-2025-28904

Vulnerability Analysis

This Blind SQL Injection vulnerability in the Web Directory Free plugin allows attackers to execute arbitrary SQL commands against the underlying WordPress database without requiring authentication. Blind SQL Injection is particularly insidious as it enables data extraction even when the application does not directly display query results to the attacker.

The vulnerability enables unauthorized access to database contents with potential for high confidentiality impact. The attack can be executed remotely over the network with low complexity and requires no user interaction, making it highly exploitable. Additionally, the vulnerability has a limited availability impact, as excessive exploitation could degrade database performance or cause denial of service conditions.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper sanitization of user-supplied data before incorporating it into SQL queries. The Web Directory Free plugin fails to properly escape or parameterize user input, allowing specially crafted input to break out of the intended query context and execute attacker-controlled SQL statements.

WordPress provides built-in functions such as $wpdb->prepare() for safe query parameterization, but the vulnerable code paths in this plugin bypass these protections, directly concatenating user input into SQL query strings.

Attack Vector

The attack vector is network-based, allowing remote unauthenticated attackers to exploit this vulnerability by sending crafted HTTP requests to the vulnerable WordPress site. The Blind SQL Injection technique involves inferring database information through timing-based or boolean-based responses:

Boolean-based Blind SQL Injection: The attacker crafts input that causes the application to return different responses based on whether a condition is true or false, allowing bit-by-bit extraction of data.

Time-based Blind SQL Injection: The attacker uses SQL commands that introduce delays (such as SLEEP() or BENCHMARK() functions) to infer information based on response timing differences.

For technical details on this vulnerability, refer to the Patchstack vulnerability database entry.

Detection Methods for CVE-2025-28904

Indicators of Compromise

• Unusual database query patterns containing SQL injection payloads such as SLEEP(), BENCHMARK(), UNION SELECT, or boolean logic operators
• Abnormal response times from the web server indicating time-based SQL injection attempts
• Web application firewall (WAF) alerts for SQL injection signatures targeting the Web Directory Free plugin endpoints
• Unexpected database errors or warnings in WordPress debug logs

Detection Strategies

• Deploy web application firewall rules to detect and block common SQL injection patterns and payloads
• Monitor HTTP request logs for suspicious parameters containing SQL syntax or encoding evasion techniques
• Implement database activity monitoring to identify anomalous query patterns or unauthorized data access
• Use SentinelOne Singularity Platform to detect post-exploitation activities and lateral movement attempts

Monitoring Recommendations

• Enable detailed WordPress debug logging to capture database query errors and anomalies
• Configure alerting on repeated failed or malformed database queries from web application contexts
• Monitor network traffic for exfiltration patterns that may indicate successful data extraction
• Review web server access logs for requests targeting Web Directory Free plugin endpoints with suspicious payloads

How to Mitigate CVE-2025-28904

Immediate Actions Required

• Immediately deactivate and remove the Web Directory Free plugin from affected WordPress installations until a patched version is available
• Conduct a database audit to identify any signs of unauthorized data access or exfiltration
• Review WordPress user accounts for any unauthorized additions or privilege modifications
• Implement a web application firewall with SQL injection protection rules as an additional defense layer

Patch Information

At the time of publication, no patched version has been confirmed. Administrators should monitor the Patchstack vulnerability database for updates regarding patch availability. Consider alternative directory plugins that follow WordPress security best practices until the vendor releases a security update.

Workarounds

• Disable or remove the Web Directory Free plugin entirely from production WordPress installations
• Implement WAF rules to filter SQL injection payloads targeting directory plugin endpoints
• Restrict access to WordPress administrative and plugin areas using IP whitelisting or VPN requirements
• Enable WordPress database user principle of least privilege to limit potential damage from SQL injection attacks

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate web-directory-free --path=/var/www/html

# Verify plugin status
wp plugin status web-directory-free --path=/var/www/html

# Optional: Remove plugin entirely
wp plugin delete web-directory-free --path=/var/www/html