CVE-2025-30589 Overview
CVE-2025-30589 is a SQL injection vulnerability [CWE-89] in the Dourou Flickr set slideshows WordPress plugin (flickr-set-slideshows). The flaw affects all plugin versions up to and including 0.9. Authenticated attackers with low privileges can inject malicious SQL statements through unsanitized input passed to database queries. Exploitation occurs over the network without user interaction and crosses a security scope boundary, exposing confidential database contents and degrading service availability.
Critical Impact
Low-privileged attackers can extract sensitive WordPress database contents, including user credentials and configuration data, through crafted SQL payloads sent to the vulnerable plugin.
Affected Products
- Dourou Flickr set slideshows plugin for WordPress
- All versions from initial release through 0.9
- WordPress sites with the flickr-set-slideshows plugin installed and activated
Discovery Timeline
- 2025-04-01 - CVE-2025-30589 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30589
Vulnerability Analysis
The Flickr set slideshows plugin fails to neutralize special elements used in SQL commands. User-supplied input reaches database query construction without parameterization or escaping. An authenticated attacker submits crafted parameters that alter the original query logic, enabling data extraction from arbitrary tables in the WordPress database.
The vulnerability scope is changed, meaning the affected component can impact resources beyond its own security authority. Confidentiality impact is high because attackers can read the entire wp_users table and other sensitive data. Availability impact is low, reflecting potential query disruption rather than full service denial.
The EPSS score of 0.279% (percentile 19.4) indicates limited current exploitation telemetry. Public proof-of-concept code is not currently listed in CISA KEV or ExploitDB.
Root Cause
The root cause is missing input sanitization on plugin parameters consumed by database queries. The plugin concatenates request input directly into SQL strings instead of using prepared statements or the WordPress $wpdb->prepare() API. Any string containing SQL metacharacters such as single quotes, UNION, or comment sequences modifies the intended query.
Attack Vector
An attacker authenticates to the target WordPress instance with any role that can reach the vulnerable plugin endpoint. The attacker sends a crafted HTTP request containing SQL syntax in a vulnerable parameter. The injected payload executes within the WordPress database context and returns extracted data through error messages, blind boolean responses, or time-based inference.
The vulnerability mechanism is described in the Patchstack Vulnerability Report. No verified exploit code is published.
Detection Methods for CVE-2025-30589
Indicators of Compromise
- HTTP requests to flickr-set-slideshows plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
- Unexpected SELECT queries against wp_users, wp_usermeta, or wp_options originating from the plugin's PHP files
- WordPress database errors logged in debug.log referencing the plugin's query functions
- Anomalous outbound data volumes from the web server following authenticated plugin requests
Detection Strategies
- Inspect web server access logs for plugin URLs containing URL-encoded SQL syntax such as %27, %20UNION, or %20OR%201%3D1
- Deploy a web application firewall rule set with SQL injection signatures applied to /wp-content/plugins/flickr-set-slideshows/ paths
- Enable WordPress query logging and alert on parameterized queries originating outside wpdb->prepare() calls within the plugin
Monitoring Recommendations
- Monitor authenticated session activity for accounts interacting with the plugin and correlate with database query volume
- Alert on creation of new administrator accounts or modification of the wp_optionssiteurl value following plugin requests
- Track failed and successful logins from IP addresses that have triggered SQL injection detection signatures
How to Mitigate CVE-2025-30589
Immediate Actions Required
- Deactivate and remove the flickr-set-slideshows plugin from all WordPress installations until a patched version is released
- Rotate all WordPress administrator and database credentials if the plugin has been active and exposed to untrusted authenticated users
- Audit the wp_users table for unauthorized accounts and review recent wp_options modifications
Patch Information
No vendor patch is currently referenced in the NVD entry or the Patchstack advisory. The vulnerability affects all versions up to and including 0.9 with no known fixed release. Site operators should treat the plugin as end-of-life until the maintainer publishes a remediated version.
Workarounds
- Restrict access to WordPress authenticated areas using IP allowlisting or VPN gating to reduce the attacker pool
- Apply a WAF policy that blocks SQL metacharacters on requests targeting the plugin's endpoints
- Replace the plugin with an actively maintained alternative that uses the WordPress $wpdb->prepare() API for all database queries
# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate flickr-set-slideshows
wp plugin delete flickr-set-slideshows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
