CVE-2025-30788: EZ SQL Reports CSRF Vulnerability

CVE-2025-30788 Overview

CVE-2025-30788 is a Cross-Site Request Forgery (CSRF) vulnerability in the Eli EZ SQL Reports Shortcode Widget and DB Backup WordPress plugin (elisqlreports). The flaw chains CSRF with SQL Injection, allowing an attacker to execute attacker-controlled SQL statements against the WordPress database when an authenticated administrator visits a malicious page. The issue affects all plugin versions up to and including 5.25.08. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact

An attacker can trick an authenticated administrator into submitting a forged request that executes arbitrary SQL, exposing sensitive database contents and impacting site availability.

Affected Products

• Eli EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress
• All plugin versions from initial release through 5.25.08
• WordPress sites with administrator sessions active during attacker-controlled browsing

Discovery Timeline

• 2025-03-27 - CVE-2025-30788 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30788

Vulnerability Analysis

The plugin exposes administrative actions that build SQL statements from user-supplied parameters without enforcing anti-CSRF protections. Endpoints lack valid WordPress nonce verification (wp_verify_nonce) and do not validate the request origin. An attacker who controls a web page visited by an authenticated administrator can issue a forged HTTP request to the vulnerable endpoint. The administrator's browser automatically attaches session cookies, so WordPress processes the request as a legitimate privileged action.

Because the same endpoints also fail to sanitize or parameterize SQL input, the attacker-controlled payload is concatenated directly into a database query. This produces a chained CSRF-to-SQL-Injection condition. The attack requires user interaction (UI:R) but no authentication on the attacker's part (PR:N), and crosses a trust boundary into the WordPress administrative scope.

Root Cause

The root cause is twofold: missing CSRF token validation on state-changing endpoints, and unsafe construction of SQL queries that incorporate request parameters without prepared statements. Together these weaknesses allow an unauthenticated remote attacker to drive privileged SQL execution through a victim's browser.

Attack Vector

Exploitation is network-based. The attacker hosts a page containing a hidden form or XMLHttpRequest targeting the vulnerable plugin endpoint. When a logged-in WordPress administrator loads the page, the browser submits the forged request with valid authentication cookies. The injected SQL payload executes with database privileges held by the WordPress user account, typically full read and write access to all tables. Refer to the Patchstack WordPress Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2025-30788

Indicators of Compromise

• Unexpected POST or GET requests to elisqlreports plugin endpoints sourced from external Referer headers or absent Origin values.
• WordPress access logs showing administrator-initiated plugin requests immediately after the admin browsed an external site.
• Database error entries or unusual SELECT, UNION, INFORMATION_SCHEMA queries in MySQL general or slow query logs.
• New or modified rows in wp_users or wp_options, or unexplained data exports, following plugin endpoint activity.

Detection Strategies

• Inspect web server logs for requests to plugin URLs containing SQL syntax such as UNION SELECT, SLEEP(, --, or 0x hex literals.
• Correlate administrator session activity with cross-origin Referer headers pointing to untrusted domains.
• Enable WordPress debug logging and database query logging to capture malformed or injected SQL statements during plugin use.

Monitoring Recommendations

• Deploy a web application firewall (WAF) rule set that blocks common SQL injection patterns on /wp-admin/admin.php and /wp-admin/admin-post.php request paths referencing the plugin.
• Monitor for anomalous outbound database dumps or large SELECT responses originating from the WordPress host.
• Alert on creation of new administrative WordPress accounts or privilege changes in wp_usermeta.

How to Mitigate CVE-2025-30788

Immediate Actions Required

• Disable or remove the EZ SQL Reports Shortcode Widget and DB Backup plugin until a patched release is verified.
• Force a logout of all WordPress administrator sessions and rotate administrator passwords.
• Audit the WordPress database for unauthorized accounts, modified options, and exfiltration artifacts.
• Review the Patchstack advisory for vendor remediation status.

Patch Information

At the time of publication, no fixed version was identified in the NVD record beyond 5.25.08. Site operators should monitor the plugin page and the Patchstack advisory for an updated release and apply it as soon as it becomes available.

Workarounds

• Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to reduce CSRF reach.
• Require administrators to use a dedicated browser profile for WordPress administration to limit cross-site cookie exposure.
• Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress session cookies where compatible.
• Apply a virtual patch via WAF rules to block requests to the vulnerable plugin endpoints lacking a valid same-origin Referer.

# Configuration example: Apache rule to block cross-origin POSTs to the plugin
<LocationMatch "/wp-admin/.*elisqlreports.*">
    SetEnvIfNoCase Referer "^https?://your-site\.example/" local_ref
    Require env local_ref
</LocationMatch>