CVE-2025-30879: MC WooCommerce Wishlist SQLi Vulnerability

CVE-2025-30879 Overview

CVE-2025-30879 is a SQL Injection vulnerability in the Moreconvert Team MC WooCommerce Wishlist plugin (smart-wishlist-for-more-convert) for WordPress. The flaw affects all versions up to and including 1.8.9. Attackers with high privileges can inject malicious SQL statements through unsanitized input, leading to unauthorized access to the WordPress database. The vulnerability is categorized under CWE-89 for improper neutralization of special elements in SQL commands. The issue was published to the National Vulnerability Database (NVD) on March 27, 2025, and tracked through Patchstack's vulnerability database.

Critical Impact
Authenticated attackers can extract sensitive WordPress database content, including customer wishlists, order data, and user credentials, by injecting crafted SQL queries through the affected plugin.

Affected Products

Moreconvert Team MC WooCommerce Wishlist plugin (smart-wishlist-for-more-convert)
All versions from initial release through 1.8.9
WordPress installations running WooCommerce with this plugin enabled

Discovery Timeline

2025-03-27 - CVE-2025-30879 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30879

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements within SQL commands in the MC WooCommerce Wishlist plugin. User-supplied input flows into database queries without proper sanitization or parameterization. The attack requires network access and high privileges, but no user interaction. Successful exploitation impacts confidentiality at a high level, with limited availability impact and a scope change indicating that the compromise extends beyond the vulnerable component to other resources.

Root Cause

The root cause is the plugin's failure to use prepared statements or properly escape user-controllable parameters before concatenating them into SQL queries. WordPress provides the $wpdb->prepare() method to safely parameterize queries, but the affected plugin code paths did not apply this protection consistently. As a result, attacker-controlled values reach the MySQL backend as raw SQL fragments rather than as bound parameters.

Attack Vector

An authenticated attacker with elevated privileges sends crafted HTTP requests to vulnerable plugin endpoints. The injected payloads modify query logic to extract data, bypass authentication checks within the database layer, or read information from other database tables. Because the CVSS scope is marked as changed, an exploit against the WooCommerce wishlist component can affect the broader WordPress database resources, including users, orders, and session metadata.

No public proof-of-concept exploit code has been released for this vulnerability. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30879

Indicators of Compromise

Unusual SQL syntax (e.g., UNION SELECT, SLEEP(, ' OR 1=1) in WordPress web server access logs targeting plugin endpoints
Unexpected outbound database errors or MySQL warnings in PHP error logs referencing wishlist-related queries
Anomalous administrative or editor account activity preceding requests to smart-wishlist-for-more-convert endpoints

Detection Strategies

Inspect HTTP request parameters sent to the plugin's REST or AJAX endpoints for SQL metacharacters and tautology patterns
Correlate authenticated session activity with database query anomalies, such as long-running queries or queries returning unusually large result sets
Deploy a web application firewall (WAF) with rule sets tuned for WordPress and WooCommerce plugin injection patterns

Monitoring Recommendations

Enable WordPress audit logging to capture privileged user actions and plugin interactions
Monitor MySQL slow query logs and general query logs for query patterns inconsistent with normal wishlist operations
Alert on changes to user roles, password hashes, or option tables that may indicate post-exploitation database tampering

How to Mitigate CVE-2025-30879

Immediate Actions Required

Update the MC WooCommerce Wishlist plugin to a version later than 1.8.9 as soon as a vendor-patched release is available
Audit WordPress accounts with elevated privileges and revoke unused administrator or shop manager roles
Restrict administrative panel access to trusted IP addresses through web server or WAF controls

Patch Information

At the time of NVD publication, the advisory listed affected versions through 1.8.9 with no fixed version explicitly referenced in the CVE record. Administrators should consult the Patchstack Vulnerability Report and the plugin vendor for the latest remediation guidance.

Workarounds

Disable and remove the smart-wishlist-for-more-convert plugin until a patched version is installed
Apply virtual patching through a WAF with rules targeting SQL injection patterns on plugin URIs
Enforce least-privilege role assignments to reduce the number of accounts capable of reaching the vulnerable code paths

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate smart-wishlist-for-more-convert
wp plugin delete smart-wishlist-for-more-convert