CVE-2025-30570: Dokme Social Shopping SQL Injection Flaw

CVE-2025-30570 Overview

CVE-2025-30570 is a SQL Injection vulnerability affecting the AliRezaMohammadi دکمه، شبکه اجتماعی خرید (dokme) WordPress plugin. The flaw exists in versions up to and including 2.0.6 and stems from improper neutralization of special elements used in an SQL command [CWE-89]. An authenticated attacker with high privileges can inject SQL statements through unsanitized input parameters. Successful exploitation can expose confidential database contents and degrade availability of the affected WordPress site. The scope is changed, meaning the impact can extend beyond the vulnerable component to other resources in the WordPress environment.

Critical Impact
Authenticated attackers can extract sensitive WordPress database content and disrupt site availability through crafted SQL payloads against the dokme plugin.

Affected Products

AliRezaMohammadi دکمه، شبکه اجتماعی خرید (dokme) WordPress plugin
Versions from n/a through 2.0.6
WordPress sites with the dokme plugin installed and active

Discovery Timeline

2025-03-24 - CVE-2025-30570 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30570

Vulnerability Analysis

The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The dokme plugin accepts input that is concatenated directly into SQL queries without proper sanitization or use of prepared statements. An attacker with high-privilege authentication can submit crafted parameters that break out of the intended SQL context. The attack is network-reachable and requires no user interaction. Because the CVSS scope is marked as changed, an injected query can read or affect data outside the plugin's own tables, including core WordPress tables such as wp_users and wp_options. Confidentiality impact is high, with low availability impact and no direct integrity impact reported. The current EPSS probability indicates a relatively low likelihood of observed exploitation activity in the near term.

Root Cause

The root cause is the construction of SQL queries using unsanitized user-supplied input. The plugin does not apply $wpdb->prepare() or equivalent parameter binding before passing values into database queries. Special characters such as single quotes, comments, and UNION operators are not neutralized.

Attack Vector

Exploitation requires an authenticated session with elevated privileges within WordPress. The attacker submits crafted parameters to a vulnerable plugin endpoint over HTTP or HTTPS. The injected SQL payload executes within the database context used by WordPress, enabling arbitrary SELECT, time-based blind extraction, or UNION-based data retrieval. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-30570

Indicators of Compromise

HTTP requests to dokme plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Unexpected SELECT queries against wp_users or wp_usermeta originating from PHP worker processes
Anomalous database response time spikes consistent with time-based blind SQL injection
New or modified WordPress administrator accounts following plugin endpoint activity

Detection Strategies

Inspect web server access logs for parameter values to dokme endpoints containing SQL syntax tokens
Enable MySQL general query logging temporarily and review queries referencing dokme-related tables
Deploy a Web Application Firewall (WAF) rule set tuned for SQL injection patterns against /wp-admin/ and plugin AJAX endpoints
Correlate authenticated session activity with database error rates to surface injection probing

Monitoring Recommendations

Forward WordPress, PHP-FPM, and MySQL logs to a centralized analytics platform for cross-source correlation
Alert on privileged WordPress account logins followed by abnormal query volume within short time windows
Track plugin version inventory across WordPress hosts to identify systems still running dokme <= 2.0.6
Monitor for outbound data transfers from web hosts that deviate from baseline volumes

How to Mitigate CVE-2025-30570

Immediate Actions Required

Deactivate and remove the dokme plugin until a fixed version is confirmed available from the vendor
Audit WordPress administrator and editor accounts and rotate credentials for any high-privilege users
Review database access logs for evidence of unauthorized SELECT activity against sensitive tables
Restrict access to /wp-admin/ using IP allowlisting or network-level controls where feasible

Patch Information

No fixed version is identified in the available advisory data. The Patchstack entry lists affected versions through 2.0.6. Administrators should consult the Patchstack advisory for vendor updates and remove the plugin if no patched release is available.

Workarounds

Remove the dokme plugin entirely from production WordPress installations
Deploy a virtual patch via WAF rules that block SQL metacharacters on dokme endpoint parameters
Enforce the principle of least privilege by reducing the number of accounts with administrative roles
Apply database-level controls so the WordPress database user has only the privileges required for normal operation

bash

# Configuration example: disable the dokme plugin via WP-CLI
wp plugin deactivate dokme
wp plugin delete dokme

# Verify the plugin is no longer installed
wp plugin list --status=active | grep -i dokme