CVE-2025-30784: WP Subscription Forms SQLi Vulnerability

CVE-2025-30784 Overview

CVE-2025-30784 is a SQL Injection vulnerability in the WP Shuffle WP Subscription Forms plugin for WordPress. The flaw affects all versions of wp-subscription-forms up to and including 1.2.3. The vulnerability stems from improper neutralization of special elements used in SQL commands [CWE-89]. Authenticated attackers with low privileges can inject malicious SQL statements through the plugin to extract sensitive database content. The issue carries a CVSS 3.1 base score of 8.5 with a scope change, indicating that successful exploitation impacts resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can read confidential WordPress database records, including user credentials and personally identifiable information stored by subscription forms.

Affected Products

WP Shuffle WP Subscription Forms plugin versions through 1.2.3
WordPress installations using the wp-subscription-forms plugin
Sites where the plugin is active and accessible to authenticated users

Discovery Timeline

2025-03-27 - CVE-2025-30784 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30784

Vulnerability Analysis

The vulnerability resides in the WP Subscription Forms plugin, which provides subscription form functionality for WordPress sites. The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries executed against the WordPress database. This category of flaw maps to [CWE-89], Improper Neutralization of Special Elements used in an SQL Command.

The scope change reflected in the CVSS vector indicates that exploitation crosses a security boundary. An attacker authenticated to the WordPress instance can manipulate query parameters processed by the plugin to retrieve data from arbitrary tables, including wp_users and wp_usermeta. The EPSS score is 0.168% with a percentile of 37.6, reflecting current public exploitation likelihood.

Root Cause

The root cause is the absence of parameterized queries or proper input escaping in database calls made by the wp-subscription-forms plugin. Input fields tied to subscription form processing are concatenated directly into SQL statements without using wpdb->prepare() or equivalent sanitization routines. This allows attacker-controlled values to alter the structure of the resulting query.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated user privileges. The attacker submits crafted input through plugin-handled endpoints, embedding SQL syntax such as UNION SELECT clauses or boolean-based conditions. The injected payload executes within the WordPress database context, returning data through the application response or via blind extraction techniques. No user interaction is required beyond the attacker's own session.

The vulnerability is described in prose because no verified proof-of-concept code has been published. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-30784

Indicators of Compromise

HTTP requests to WordPress endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in plugin parameters
Unusual wpdb query errors logged in debug.log referencing the wp-subscription-forms plugin
Database access patterns showing reads of wp_users or wp_options from subscription form request flows
Outbound exfiltration traffic following authenticated sessions interacting with the plugin

Detection Strategies

Deploy a web application firewall ruleset that flags SQL metacharacters submitted to wp-admin/admin-ajax.php and plugin-specific endpoints
Enable MySQL general query logging temporarily to identify malformed or suspicious statements originating from the plugin
Correlate authenticated user activity with anomalous database query volume using SIEM analytics

Monitoring Recommendations

Monitor WordPress access logs for repeated POST or GET requests with encoded SQL payloads such as %27, %20OR%20, or --
Alert on new subscription form submissions occurring at machine-speed intervals from a single authenticated session
Track changes to user roles or unexpected administrator accounts created shortly after plugin interaction

How to Mitigate CVE-2025-30784

Immediate Actions Required

Disable or deactivate the WP Subscription Forms plugin until a patched release is verified and installed
Audit all WordPress user accounts and reset credentials for accounts with database access
Review WordPress and MySQL logs for evidence of injection attempts dating back to plugin installation
Restrict plugin endpoints behind a web application firewall pending remediation

Patch Information

At the time of publication, no fixed version beyond 1.2.3 has been confirmed by the vendor. Site administrators should monitor the Patchstack advisory for updates and apply any vendor-released patch immediately upon availability.

Workarounds

Remove the wp-subscription-forms plugin directory from wp-content/plugins/ if patching is not yet possible
Apply virtual patching through a WAF rule that blocks SQL metacharacters on plugin URIs
Restrict authenticated access to trusted administrators only while the plugin remains installed
Enforce least-privilege database credentials for the WordPress MySQL user to limit exposure

bash

# Configuration example: temporarily remove the vulnerable plugin
wp plugin deactivate wp-subscription-forms
wp plugin delete wp-subscription-forms