CVE-2025-30998: WP Links Page SQL Injection Vulnerability

CVE-2025-30998 Overview

CVE-2025-30998 is a SQL Injection vulnerability in the Rico Macchi WP Links Page WordPress plugin. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. It affects all versions of wp-links-page from initial release through 4.9.6. An authenticated attacker with low privileges can inject crafted SQL statements over the network without user interaction. Successful exploitation exposes confidential database contents and can degrade application availability. The issue carries a scope change, meaning impact extends beyond the vulnerable component to the broader WordPress environment.

Critical Impact
Authenticated attackers can extract sensitive WordPress database contents, including user records and credentials, through SQL injection against the WP Links Page plugin.

Affected Products

Rico Macchi WP Links Page plugin for WordPress
All versions up to and including 4.9.6
WordPress sites with the wp-links-page plugin installed and activated

Discovery Timeline

2025-08-14 - CVE-2025-30998 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30998

Vulnerability Analysis

The WP Links Page plugin fails to sanitize user-controllable input before incorporating it into SQL queries. An attacker authenticated to WordPress with low-level privileges sends crafted parameters to a vulnerable plugin endpoint. The backend concatenates this input directly into an SQL statement executed against the WordPress database. The injection breaks the intended query structure and lets the attacker append arbitrary clauses such as UNION SELECT payloads. The attack runs over the network with low complexity and no user interaction. The scope change indicator reflects that data outside the plugin, including core WordPress tables like wp_users and wp_options, is reachable.

Root Cause

The vulnerability is a classic CWE-89 failure. Input from request parameters reaches a database query without parameterized statements, prepared queries, or proper escaping through $wpdb->prepare(). Trust boundaries between request handlers and the database layer are not enforced.

Attack Vector

Exploitation requires a valid WordPress account with at least subscriber-level access. The attacker submits malicious SQL fragments to a plugin endpoint exposed to authenticated users. No social engineering or victim interaction is required. Refer to the Patchstack SQL Injection Advisory for technical specifics.

Detection Methods for CVE-2025-30998

Indicators of Compromise

Web server access logs containing SQL meta-characters such as UNION SELECT, SLEEP(, --, 0x, or INFORMATION_SCHEMA in requests to wp-links-page endpoints
Unexpected database errors in PHP logs originating from the wp-links-page plugin code paths
Anomalous outbound data volumes from the WordPress host following requests to plugin URLs

Detection Strategies

Deploy a web application firewall ruleset that flags SQL injection signatures targeting /wp-admin/admin-ajax.php and wp-links-page request parameters
Monitor MySQL or MariaDB query logs for malformed statements referencing plugin tables
Correlate authenticated session activity with elevated query volumes against WordPress core tables such as wp_users

Monitoring Recommendations

Alert on low-privilege WordPress accounts generating requests that match SQL injection patterns
Track failed login attempts followed by successful authentication and immediate plugin endpoint access
Forward WordPress, PHP, and database logs to a centralized SIEM for cross-source correlation

How to Mitigate CVE-2025-30998

Immediate Actions Required

Identify all WordPress sites running the wp-links-page plugin and confirm installed versions
Deactivate and remove WP Links Page on any site running version 4.9.6 or earlier until a fixed release is available
Rotate WordPress administrator and database credentials if exploitation is suspected
Audit the wp_users and wp_usermeta tables for unauthorized account creation or privilege changes

Patch Information

At the time of last NVD update on 2026-04-23, no fixed version was listed in the available references. Monitor the Patchstack SQL Injection Advisory and the plugin's WordPress.org page for an official update beyond 4.9.6.

Workarounds

Restrict access to authenticated plugin endpoints using IP allowlists at the web server or WAF tier
Apply virtual patching via WAF rules that block SQL injection payloads targeting wp-links-page parameters
Reduce user privileges so that untrusted accounts cannot register or authenticate to sites running the plugin

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate wp-links-page --all
wp plugin delete wp-links-page