CVE-2025-30590 Overview
CVE-2025-30590 is a SQL Injection vulnerability affecting the Dourou Flickr set slideshows WordPress plugin (flickr-set-slideshows). The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. All versions up to and including 0.9 are affected. An authenticated attacker with low privileges can inject arbitrary SQL statements through the plugin, potentially exposing database contents and impacting service availability. The vulnerability carries a network attack vector and a changed scope, meaning the impact extends beyond the vulnerable component.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, leading to confidentiality loss and partial availability disruption across the affected site.
Affected Products
- Dourou Flickr set slideshows plugin for WordPress
- All versions from n/a through <= 0.9
- WordPress sites with the flickr-set-slideshows plugin installed and active
Discovery Timeline
- 2025-03-24 - CVE-2025-30590 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30590
Vulnerability Analysis
The vulnerability resides in the Flickr set slideshows plugin's handling of user-supplied input that is incorporated into SQL queries. The plugin fails to properly sanitize or parameterize input before passing it to the WordPress database layer. As a result, attackers can break out of the intended query context and append arbitrary SQL syntax.
Exploitation requires low-level authentication, such as a subscriber or contributor account. Once authenticated, the attacker submits crafted parameters that the plugin interpolates directly into SQL statements. The changed scope indicates that injected queries can affect resources beyond the plugin's own data, including WordPress core tables containing user credentials, session tokens, and post content.
The confidentiality impact is high because attackers can extract sensitive data such as password hashes from wp_users and secret keys stored in wp_options. Availability impact is rated low, reflecting the potential for query-based disruption rather than complete denial of service.
Root Cause
The root cause is the absence of prepared statements or proper escaping when constructing SQL queries from request parameters. The plugin concatenates untrusted input into query strings instead of using the $wpdb->prepare() method provided by the WordPress database abstraction layer.
Attack Vector
The attack is delivered over the network via standard HTTP/HTTPS requests to the WordPress site. An authenticated user submits a crafted request to a plugin endpoint where the vulnerable parameter is processed. The injected SQL payload is executed by the MySQL/MariaDB backend with the privileges of the WordPress database user.
No verified public proof-of-concept code is available. Refer to the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-30590
Indicators of Compromise
- Unexpected SQL syntax such as UNION SELECT, SLEEP(, OR 1=1, or comment sequences (--, #) in web server access logs targeting flickr-set-slideshows endpoints
- Anomalous database queries originating from the WordPress application user against wp_users, wp_usermeta, or wp_options tables
- New or unexpected administrative accounts created in WordPress following plugin-related requests
Detection Strategies
- Deploy a web application firewall with WordPress-specific SQL injection rulesets to inspect requests targeting plugin paths
- Enable MySQL general query logging on staging environments to identify malformed queries originating from the plugin
- Audit installed WordPress plugins for the presence of flickr-set-slideshows at version 0.9 or earlier
Monitoring Recommendations
- Monitor authentication events for low-privilege accounts that subsequently issue requests to plugin endpoints
- Alert on database errors logged by WordPress (WPDB::print_error) that indicate syntactically broken queries
- Track outbound data volume from the web tier to detect bulk extraction consistent with SQL injection exfiltration
How to Mitigate CVE-2025-30590
Immediate Actions Required
- Deactivate and remove the flickr-set-slideshows plugin until a patched release is confirmed
- Restrict user registration and review existing low-privilege accounts that could be used for authenticated exploitation
- Rotate WordPress secret keys in wp-config.php and force password resets for all users if exploitation is suspected
Patch Information
No fixed version has been published by the vendor as of the last NVD update on 2026-04-23. The advisory tracked by Patchstack lists all versions through 0.9 as vulnerable. Site operators should monitor the Patchstack advisory for patch availability.
Workarounds
- Uninstall the plugin and replace its functionality with a maintained alternative
- Apply virtual patching through a WAF rule that blocks SQL metacharacters on plugin request parameters
- Restrict access to plugin endpoints via web server rules limiting requests to trusted IP ranges
# Example: disable the plugin via WP-CLI
wp plugin deactivate flickr-set-slideshows
wp plugin delete flickr-set-slideshows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
