CVE-2025-28967 Overview
CVE-2025-28967 is a SQL injection vulnerability in the Steve Truman Contact Us page - Contact people LITE WordPress plugin (contact-us-page-contact-people). The flaw affects all versions up to and including 3.7.4. Authenticated attackers with low privileges can inject arbitrary SQL statements through unsanitized input passed to database queries. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Attackers can read sensitive database contents, including WordPress user credentials and session tokens, and trigger limited availability impact against the underlying database.
Affected Products
- Steve Truman Contact Us page - Contact people LITE plugin for WordPress
- Plugin slug: contact-us-page-contact-people
- All versions from n/a through <= 3.7.4
Discovery Timeline
- 2025-07-04 - CVE-2025-28967 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28967
Vulnerability Analysis
The plugin fails to neutralize special SQL characters in user-controlled input before incorporating that input into database queries. Because the affected code paths accept requests from authenticated users with low privileges, any subscriber-level account can trigger the flaw. The scope is marked as changed, meaning the injection reaches resources beyond the vulnerable component itself, including the WordPress core database tables. Confidentiality impact is high because attackers can extract arbitrary data via UNION-based or blind SQL techniques.
Root Cause
The root cause is the direct concatenation of untrusted request parameters into SQL statements without using prepared statements or the WordPress $wpdb->prepare() API. The plugin does not apply escaping helpers such as esc_sql() or type-cast integer parameters before query execution. This omission allows attacker-supplied metacharacters, including single quotes and SQL comment sequences, to alter query structure.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privileged account. An attacker submits a crafted HTTP request to a vulnerable plugin endpoint, embedding SQL payloads within a parameter that the plugin passes to the database. Because no user interaction is required beyond authentication, the vulnerability is well suited for automated exploitation against sites that allow open registration.
No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Plugin Advisory for technical details.
Detection Methods for CVE-2025-28967
Indicators of Compromise
- Web server access logs containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in requests to contact-us-page-contact-people endpoints.
- Unexpected outbound queries against wp_users or wp_usermeta originating from the plugin's PHP handlers.
- Newly created WordPress administrator accounts or modified user_pass hashes following suspicious plugin requests.
Detection Strategies
- Deploy web application firewall (WAF) rules that flag SQL keywords and tautologies submitted to WordPress plugin URLs.
- Enable MySQL general query logging temporarily and correlate long or malformed queries with authenticated plugin sessions.
- Hunt across HTTP telemetry for repeated 200-status POSTs to plugin endpoints containing encoded quote characters (%27) from a single low-privileged session.
Monitoring Recommendations
- Alert on anomalous read volumes from the WordPress database process, particularly against authentication tables.
- Monitor WordPress wp_options and wp_users tables for unauthorized modifications using file integrity and database audit tooling.
- Track authentication events for subscriber-level accounts that suddenly issue requests targeting plugin admin-ajax handlers.
How to Mitigate CVE-2025-28967
Immediate Actions Required
- Deactivate the Contact Us page - Contact people LITE plugin until a fixed version is installed.
- Restrict new user registrations and audit existing low-privileged accounts for suspicious activity.
- Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected.
Patch Information
At the time of publication, the vendor advisory listed on Patchstack indicates the vulnerability affects versions up to and including 3.7.4. Site owners should upgrade to the latest available release published by Steve Truman that addresses CVE-2025-28967. Consult the Patchstack WordPress Plugin Advisory for current fix availability.
Workarounds
- Enforce WAF signatures that block SQL injection payloads targeting /wp-admin/admin-ajax.php and plugin-specific endpoints.
- Remove the plugin directory wp-content/plugins/contact-us-page-contact-people/ if the plugin is not business-critical.
- Apply the principle of least privilege by removing unnecessary subscriber accounts and disabling open registration.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate contact-us-page-contact-people
# Optional: remove plugin files entirely
wp plugin uninstall contact-us-page-contact-people
# Disable open user registration in wp-config.php or via WP-CLI
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
