CVE-2025-32120: Easy Query WP Plugin SQLi Vulnerability

CVE-2025-32120 Overview

CVE-2025-32120 is a blind SQL injection vulnerability in the Easy Query – WP Query Builder WordPress plugin developed by edanzer. The flaw affects all versions of the plugin up to and including 2.0.4. It results from improper neutralization of special elements used in an SQL command [CWE-89]. An authenticated attacker with high privileges can inject crafted SQL statements that the plugin passes to the WordPress database. Successful exploitation enables data inference through blind techniques and can affect components beyond the vulnerable plugin due to scope change.

Critical Impact
Authenticated attackers can extract sensitive WordPress database contents and impact resources beyond the plugin scope through blind SQL injection over the network.

Affected Products

Easy Query – WP Query Builder plugin for WordPress
All versions from initial release through 2.0.4
WordPress installations using the easy-query plugin slug

Discovery Timeline

2025-04-04 - CVE-2025-32120 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32120

Vulnerability Analysis

The Easy Query – WP Query Builder plugin constructs SQL queries using user-controlled input without proper sanitization or parameterization. The plugin functions as a query builder that accepts parameters and translates them into database queries, which expands the attack surface for SQL injection. Because the plugin fails to neutralize special elements such as quotes, comments, and SQL keywords, an attacker can append or modify clauses in the resulting query.

The vulnerability is blind, meaning the application does not return query results directly to the attacker. Attackers infer data using time-based or boolean-based techniques, observing application behavior to extract information one bit at a time. Exploitation requires high privileges on the WordPress instance, limiting the attacker pool to authenticated users with elevated roles such as administrators or editors with plugin access.

Root Cause

The root cause is the absence of prepared statements or proper input validation in the plugin's query construction logic. User-supplied parameters flow directly into SQL strings instead of being bound as parameters through the WordPress $wpdb->prepare() API. This pattern is the classic instance of [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

An authenticated attacker submits crafted input through plugin-exposed endpoints or shortcodes that accept query builder parameters. The malicious payload modifies the underlying SQL query structure. Because the vulnerability changes scope, injected queries can read data from tables outside the plugin's intended access, including wp_users and wp_usermeta. The attacker uses conditional responses or response timing to reconstruct extracted data.

No public proof-of-concept code is available. Refer to the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2025-32120

Indicators of Compromise

Unusual HTTP POST or GET requests to plugin endpoints containing SQL metacharacters such as ', --, UNION, SLEEP(, or BENCHMARK(.
Database query logs showing malformed or unusually long SQL statements originating from the easy-query plugin code paths.
Repeated authenticated requests from a single privileged account with response time anomalies indicative of time-based blind injection.

Detection Strategies

Enable WordPress query logging and review queries generated by the easy-query plugin for unexpected UNION, SELECT, or conditional patterns.
Deploy web application firewall rules that inspect parameters for SQL injection signatures targeting WordPress plugin endpoints.
Correlate authentication logs with plugin activity to identify privileged accounts generating anomalous query patterns.

Monitoring Recommendations

Monitor administrator and editor account behavior for sudden spikes in plugin interactions or query builder usage.
Alert on outbound database response time variance that may indicate time-based blind SQL injection probes.
Track plugin version inventory across WordPress instances to identify hosts still running easy-query version 2.0.4 or earlier.

How to Mitigate CVE-2025-32120

Immediate Actions Required

Identify all WordPress sites running the Easy Query – WP Query Builder plugin and confirm installed versions.
Disable or remove the easy-query plugin on affected sites until a fixed version is confirmed installed.
Audit privileged WordPress accounts and rotate credentials for any account that may have been used to test or exploit the vulnerability.

Patch Information

At the time of publication, the advisory lists affected versions as n/a through <= 2.0.4. Administrators should consult the Patchstack SQL Injection Advisory and the WordPress plugin repository for any released version above 2.0.4 and apply it immediately.

Workarounds

Restrict access to plugin functionality by removing the plugin or limiting privileged role assignments to trusted administrators only.
Place the WordPress site behind a web application firewall configured with SQL injection rule sets targeting WordPress plugins.
Apply database-layer least privilege by ensuring the WordPress database user cannot access tables or schemas outside the WordPress installation.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate easy-query
wp plugin delete easy-query