CVE-2025-30806: Vimeotheque WordPress Plugin SQLi Flaw

CVE-2025-30806 Overview

CVE-2025-30806 is a SQL Injection vulnerability in the Vimeotheque WordPress plugin (codeflavors-vimeo-video-post-lite) developed by Constantin Boiangiu. The flaw affects all plugin versions up to and including 2.3.4.2. The issue stems from improper neutralization of special elements used in an SQL command [CWE-89], allowing authenticated attackers with low privileges to inject arbitrary SQL into database queries. Successful exploitation can expose sensitive database contents and impact site availability.

Critical Impact

Authenticated attackers with low-level privileges can execute arbitrary SQL queries against the WordPress database, leading to high confidentiality impact and partial availability impact with scope change.

Affected Products

• Vimeotheque WordPress plugin (codeflavors-vimeo-video-post-lite)
• All versions from initial release through 2.3.4.2
• WordPress installations with the plugin enabled

Discovery Timeline

• 2025-03-27 - CVE-2025-30806 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30806

Vulnerability Analysis

The Vimeotheque plugin imports and manages Vimeo videos as WordPress posts. The vulnerability resides in plugin code paths that incorporate user-supplied input into SQL queries without proper sanitization or parameterization. An authenticated attacker can craft a request containing malicious SQL syntax that the plugin concatenates directly into a database query. The query executes with the privileges of the WordPress database user, exposing data across multiple tables. The scope-changing nature of the issue means a compromised component can affect resources beyond its immediate security boundary.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The plugin fails to use prepared statements or apply WordPress core sanitization functions such as $wpdb->prepare() or esc_sql() before incorporating request parameters into queries. This allows attacker-controlled input to break out of the intended query context and inject additional SQL clauses.

Attack Vector

The attack is delivered over the network and requires low-level authenticated access to the WordPress instance. No user interaction is required. An attacker submits crafted HTTP requests containing SQL metacharacters to vulnerable plugin endpoints. The injected payload can use UNION SELECT clauses to exfiltrate data from wp_users, wp_options, or other tables, or use stacked subqueries to enumerate database schema. See the PatchStack SQL Injection Advisory for additional context.

Detection Methods for CVE-2025-30806

Indicators of Compromise

• Unusual HTTP requests to Vimeotheque plugin endpoints containing SQL metacharacters such as UNION, SELECT, --, or encoded equivalents
• Unexpected database errors logged by WordPress or the MySQL/MariaDB server
• New or modified administrator accounts in wp_users without a corresponding admin action
• Outbound network connections from the web server immediately following plugin requests

Detection Strategies

• Inspect web server access logs for requests targeting Vimeotheque plugin paths with suspicious query parameters
• Enable MySQL general query logging temporarily to identify malformed or unexpected queries originating from the plugin
• Deploy a Web Application Firewall (WAF) ruleset configured to identify SQL injection patterns against WordPress endpoints

Monitoring Recommendations

• Monitor authenticated session activity for low-privilege users issuing requests to plugin administration endpoints
• Alert on schema-level queries such as information_schema.tables or information_schema.columns originating from the WordPress database user
• Track plugin version inventory across WordPress fleets to identify hosts still running 2.3.4.2 or earlier

How to Mitigate CVE-2025-30806

Immediate Actions Required

• Identify all WordPress sites running the Vimeotheque plugin and confirm installed version against 2.3.4.2
• Restrict authenticated user registration and audit existing accounts with contributor-level or higher access
• Apply WAF rules that block SQL injection payloads targeting plugin endpoints until a patched version is deployed

Patch Information

At the time of publication, the vendor advisory tracked through the PatchStack SQL Injection Advisory identifies all versions through 2.3.4.2 as vulnerable. Administrators should upgrade to a fixed release once published by the maintainer and verify integrity of the installed plugin files.

Workarounds

• Deactivate and remove the Vimeotheque plugin until a patched version is available
• Restrict access to WordPress administrative endpoints using IP allow-listing at the web server or WAF layer
• Enforce least-privilege roles and remove unnecessary contributor or author accounts that could be leveraged for authenticated exploitation

# Configuration example - identify vulnerable installations via WP-CLI
wp plugin list --name=codeflavors-vimeo-video-post-lite --fields=name,status,version

# Deactivate the plugin pending an upstream fix
wp plugin deactivate codeflavors-vimeo-video-post-lite