CVE-2025-30765: FlexStock WooCommerce SQL Injection Flaw

CVE-2025-30765 Overview

CVE-2025-30765 is a blind SQL injection vulnerability in the WPPOOL FlexStock plugin for WooCommerce, formally known as stock-sync-with-google-sheet-for-woocommerce. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. It affects all plugin versions up to and including 3.13.1. An authenticated attacker with high privileges can inject SQL through vulnerable parameters and extract sensitive database content via blind techniques. The issue carries scope change implications, meaning successful exploitation can impact resources beyond the plugin's own security boundary. WordPress administrators running affected versions on WooCommerce stores should update immediately.

Critical Impact
Authenticated attackers can extract confidential WordPress and WooCommerce database content, including customer records and credentials, through blind SQL injection against the FlexStock plugin.

Affected Products

WPPOOL FlexStock (stock-sync-with-google-sheet-for-woocommerce) versions through 3.13.1
WordPress installations running WooCommerce with the FlexStock plugin enabled
E-commerce sites synchronizing inventory between WooCommerce and Google Sheets via FlexStock

Discovery Timeline

2025-03-27 - CVE-2025-30765 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30765

Vulnerability Analysis

The FlexStock plugin synchronizes WooCommerce product stock with Google Sheets and exposes administrative endpoints that build SQL statements from request parameters. One or more of these parameters reach the database layer without proper sanitization or parameterized binding. An attacker submits crafted input that alters query logic, then infers data values from response timing or boolean conditions. Because the injection is blind, the response does not return raw query output, but attackers automate inference through tools such as sqlmap. The vulnerability requires high privileges, which limits exploitation to authenticated users with elevated WordPress roles, but the scope change indicates the injected query can touch data belonging to other tenants or components on the same database.

Root Cause

The root cause is failure to use parameterized queries or WordPress's $wpdb->prepare() helper when constructing SQL statements from user-controlled input. Special characters such as single quotes, comments, and UNION clauses pass through to the SQL engine.

Attack Vector

Exploitation occurs over the network against the WordPress admin interface. An authenticated administrator or equivalent role submits a crafted HTTP request to a vulnerable FlexStock endpoint. The injected payload uses boolean or time-based techniques to enumerate database schema and exfiltrate records. See the Patchstack advisory for additional context.

Detection Methods for CVE-2025-30765

Indicators of Compromise

Outbound or internal HTTP requests to FlexStock admin endpoints containing SQL metacharacters such as ', --, UNION, SLEEP(, or BENCHMARK(
Unusually long response times from wp-admin endpoints associated with the FlexStock plugin, indicating time-based blind injection
Spikes in database query volume or repeated near-identical queries from a single authenticated session

Detection Strategies

Inspect web server access logs for repeated parameterized requests to FlexStock routes with encoded SQL syntax
Enable MySQL or MariaDB general query logging temporarily and search for queries containing user-controlled fragments concatenated into WHERE clauses
Deploy a Web Application Firewall (WAF) rule set, such as OWASP CRS, to flag SQL injection patterns against /wp-admin/admin-ajax.php and FlexStock-specific routes

Monitoring Recommendations

Alert on administrator sessions issuing high volumes of plugin requests in a short window
Monitor WordPress audit logs for privilege use by accounts that do not normally administer inventory
Forward WordPress, web server, and database logs to a centralized SIEM and correlate authentication events with database anomalies

How to Mitigate CVE-2025-30765

Immediate Actions Required

Update the FlexStock plugin to a version later than 3.13.1 once the vendor publishes a fix
Audit WordPress administrator accounts and remove unused or stale privileged users
Rotate WordPress, database, and Google Sheets API credentials if compromise is suspected
Restrict access to /wp-admin/ by IP allow-list where operationally feasible

Patch Information

Refer to the Patchstack FlexStock advisory for the latest patched version. Apply the vendor update through the WordPress plugin manager and verify the installed version is greater than 3.13.1 after the upgrade.

Workarounds

Deactivate and remove the FlexStock plugin until a patched release is verified
Place a WAF in front of the WordPress site with SQL injection signatures enabled
Enforce multi-factor authentication on all WordPress administrator accounts to raise the cost of acquiring the high privileges required for exploitation
Apply the principle of least privilege to the MySQL user that WordPress uses, limiting it to the WordPress schema only

bash

# Example: restrict MySQL privileges for the WordPress database user
REVOKE ALL PRIVILEGES ON *.* FROM 'wp_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress_db.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;