CVE-2025-30810: WP Leads Builder Any CRM SQL Injection

CVE-2025-30810 Overview

CVE-2025-30810 is a blind SQL injection vulnerability in the Smackcoders Lead Form Data Collection to CRM (wp-leads-builder-any-crm) WordPress plugin. The flaw affects all plugin versions up to and including 3.0.1. The vulnerability results from improper neutralization of special elements in SQL commands [CWE-89]. Authenticated attackers with low privileges can inject crafted SQL payloads through vulnerable parameters. Successful exploitation exposes database contents and can compromise data confidentiality across the WordPress site.

Critical Impact
Authenticated attackers can extract sensitive database contents from WordPress sites running the plugin, including credentials, CRM lead data, and personally identifiable information.

Affected Products

Smackcoders Lead Form Data Collection to CRM (wp-leads-builder-any-crm) plugin for WordPress
All versions from n/a through <= 3.0.1
WordPress installations with the affected plugin enabled

Discovery Timeline

2025-03-27 - CVE-2025-30810 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30810

Vulnerability Analysis

The vulnerability exists in the Lead Form Data Collection to CRM plugin, which integrates WordPress lead forms with external CRM platforms. User-supplied input reaches SQL query construction without proper sanitization or parameterized query use. Attackers submit crafted values that alter the intended SQL statement logic on the backend database.

Because the flaw is a blind SQL injection variant, the application does not return query output directly. Attackers infer database contents through boolean-based responses or time-based payload behavior. Extraction of tables such as wp_users and wp_usermeta is achievable through iterative queries. The network attack vector and low privilege requirement make automated exploitation feasible against exposed WordPress deployments.

Root Cause

The root cause is the concatenation of untrusted input into SQL statements without prepared statements or input validation. WordPress provides the $wpdb->prepare() API for safe parameter binding, but the affected code paths do not use it consistently. This maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An authenticated user with low-level privileges submits crafted payloads to a vulnerable plugin endpoint. Payloads include SQL syntax such as boolean conditions or SLEEP() calls that influence server response timing or content. The scope change indicates that successful exploitation impacts resources beyond the vulnerable component itself, including the underlying WordPress database.

No public proof-of-concept exploit or entry in the CISA Known Exploited Vulnerabilities catalog exists at this time. See the Patchstack WordPress Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-30810

Indicators of Compromise

Unexpected SLEEP(), BENCHMARK(), UNION SELECT, or SUBSTRING() tokens in HTTP request bodies or query strings targeting plugin endpoints
Repeated authenticated POST requests to wp-leads-builder-any-crm admin-ajax handlers from a single account
Anomalous MySQL query latency spikes correlating with plugin request timestamps
Elevated volumes of failed or slow queries in the WordPress database error log

Detection Strategies

Enable WordPress query logging and inspect for malformed statements originating from plugin request handlers
Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin endpoints
Correlate authenticated session activity with database query anomalies through centralized log analysis
Monitor for privilege enumeration patterns such as sequential requests probing single-character comparisons

Monitoring Recommendations

Alert on any request to plugin endpoints containing SQL metacharacters such as ', --, /*, or ;
Track outbound data volume from database servers to detect exfiltration attempts
Review WordPress access logs weekly for authenticated low-privilege accounts issuing administrative-scoped requests
Establish baselines for plugin request timing and flag deviations that suggest time-based injection

How to Mitigate CVE-2025-30810

Immediate Actions Required

Disable the Lead Form Data Collection to CRM plugin until a patched version is verified installed
Audit all WordPress user accounts and revoke unnecessary contributor or higher-level access
Rotate WordPress database credentials and administrator passwords if compromise is suspected
Review CRM integrations and lead databases for unauthorized modifications or exports

Patch Information

At the time of publication, no fixed version is listed in the advisory. Administrators should monitor the Patchstack WordPress Vulnerability Advisory and the Smackcoders vendor page for release of a version above 3.0.1 that addresses the SQL injection flaw.

Workarounds

Deactivate and remove the wp-leads-builder-any-crm plugin until a patched release is published
Deploy WAF rules that block SQL syntax in requests to /wp-admin/admin-ajax.php actions registered by the plugin
Restrict access to WordPress admin functionality by IP allowlist where feasible
Enforce least-privilege role assignments so no untrusted user holds accounts above the Subscriber role

bash

# Example ModSecurity rule to block SQLi patterns targeting the plugin endpoint
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1030810,\
   msg:'Potential SQLi against wp-leads-builder-any-crm (CVE-2025-30810)'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|;)" "t:none,t:urlDecodeUni"