CVE-2025-30791: WooCommerce Cart Tracking SQLi Vulnerability

CVE-2025-30791 Overview

CVE-2025-30791 is a SQL injection vulnerability in the wpdever Cart tracking for WooCommerce WordPress plugin. The flaw affects all versions up to and including 1.0.16 and is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Authenticated attackers with high privileges can inject arbitrary SQL statements into database queries used by the plugin. Successful exploitation leads to confidentiality loss across the WordPress database, with scope change extending impact to other components. The vulnerability was published to the National Vulnerability Database (NVD) on March 27, 2025.

Critical Impact
Attackers with elevated privileges can extract sensitive data from the WordPress database, including customer records, order data, and administrator credentials stored by WooCommerce.

Affected Products

wpdever Cart tracking for WooCommerce plugin versions through 1.0.16
WordPress sites running WooCommerce with the vulnerable plugin installed
Any WooCommerce store configuration relying on cart-tracking-for-woocommerce

Discovery Timeline

2025-03-27 - CVE-2025-30791 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30791

Vulnerability Analysis

The Cart tracking for WooCommerce plugin fails to properly neutralize special characters in user-supplied input before incorporating that input into SQL queries. This is a classic CWE-89 violation. When a privileged user submits crafted input, the plugin concatenates or interpolates it directly into database statements without safe parameterization. The scope change component indicates that a successful injection can affect resources beyond the vulnerable component, likely due to WordPress database sharing across plugins and core tables. The EPSS score of 0.562% reflects a low but non-trivial probability of exploitation attempts. Additional context is available in the Patchstack advisory.

Root Cause

The root cause is missing input sanitization and lack of prepared statements in the plugin's database interaction code. Parameters passed through admin-facing endpoints are inserted into SQL queries without using $wpdb->prepare() or equivalent placeholder binding. This allows syntactic breakout of the intended SQL context.

Attack Vector

The attack is delivered over the network by an authenticated user holding high-level privileges within the WordPress site. The attacker submits a crafted request containing SQL metacharacters to a plugin endpoint. The injected payload executes within the WordPress database context, enabling UNION-based extraction or SELECT piggybacking against tables such as wp_users and wp_options.

No verified public proof-of-concept code is available. See the Patchstack advisory for technical details.

Detection Methods for CVE-2025-30791

Indicators of Compromise

Unexpected SQL syntax fragments such as UNION SELECT, SLEEP(, or information_schema in HTTP request parameters targeting cart-tracking-for-woocommerce endpoints
Anomalous administrative sessions issuing repeated requests to plugin AJAX or admin-post handlers
Database error messages surfaced in HTTP responses referencing MySQL syntax faults

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to /wp-admin/admin-ajax.php and plugin-specific paths for SQL injection signatures
Enable MySQL general or slow query logging and alert on queries containing operator patterns inconsistent with the plugin's normal behavior
Correlate authenticated admin activity with outbound queries returning large row counts from wp_users or wp_usermeta

Monitoring Recommendations

Monitor WordPress audit logs for privilege changes and plugin configuration modifications
Track HTTP response sizes for plugin endpoints — sudden increases suggest data exfiltration via injection
Alert on new administrator accounts or unexpected password resets following plugin interaction

How to Mitigate CVE-2025-30791

Immediate Actions Required

Deactivate and remove the Cart tracking for WooCommerce plugin until a fixed version is confirmed
Restrict administrative access to trusted personnel and enforce multi-factor authentication on all high-privilege accounts
Review WordPress user accounts and audit logs for signs of unauthorized activity or credential abuse
Rotate database credentials and WordPress secret keys defined in wp-config.php if compromise is suspected

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed version has been recorded in the enriched data. Vulnerable versions include all releases through 1.0.16. Consult the Patchstack advisory for the latest remediation guidance from the vendor.

Workarounds

Apply virtual patching through a WAF to block SQL metacharacters on plugin request parameters
Enforce least privilege — reduce the number of accounts with manage_options or administrator roles
Restrict access to /wp-admin/ by IP allowlist where operationally feasible
Enable Patchstack, Wordfence, or an equivalent WordPress security layer to block known exploitation patterns

bash

# Example ModSecurity rule to block SQL injection patterns on plugin endpoints
SecRule REQUEST_URI "@contains cart-tracking-for-woocommerce" \
  "chain,phase:2,deny,status:403,id:1030791,msg:'Block SQLi against CVE-2025-30791'"
  SecRule ARGS "@rx (?i)(union[\s\/*]+select|sleep\s*\(|information_schema|--\s|;\s*drop\s)" \
    "t:none,t:urlDecodeUni"