CVE-2025-32127: onOffice for WP-Websites SQLi Flaw

CVE-2025-32127 Overview

CVE-2025-32127 is a SQL Injection vulnerability in the onOffice GmbH onOffice for WP-Websites WordPress plugin. The flaw stems from improper neutralization of special elements used in SQL commands, classified as [CWE-89]. It affects all plugin versions up to and including 5.7. An authenticated attacker with high privileges can inject arbitrary SQL statements through vulnerable plugin parameters. Successful exploitation can expose sensitive database contents and partially impact availability, with scope change extending impact beyond the affected component.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, real estate listing data, and other sensitive records stored by the plugin.

Affected Products

onOffice GmbH onOffice for WP-Websites plugin versions up to and including 5.7
WordPress sites running the onoffice-for-wp-websites plugin
Real estate websites integrating the onOffice CRM via this plugin

Discovery Timeline

2025-04-04 - CVE-2025-32127 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32127

Vulnerability Analysis

The vulnerability resides in the onOffice for WP-Websites plugin, which integrates the onOffice real estate CRM with WordPress sites. User-supplied input reaches SQL query construction without proper sanitization or parameterization. An attacker authenticated with high privileges can manipulate query logic by injecting crafted SQL fragments.

The attack is network-exploitable and requires no user interaction. The scope is changed, meaning the impact reaches resources beyond the vulnerable plugin component, typically the underlying WordPress database and any data shared across the site. Confidentiality impact is high, while availability impact is low and integrity is unaffected based on the published vector.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The plugin concatenates request parameters into SQL statements without applying prepared statements, parameter binding, or input escaping through the WordPress $wpdb->prepare() API. Special characters such as single quotes, comments, and UNION operators pass through unfiltered into the database driver.

Attack Vector

Exploitation occurs over the network through HTTP requests targeting vulnerable plugin endpoints. The attacker must hold authenticated high-privilege access on the WordPress instance. After authenticating, the attacker submits crafted parameter values containing SQL syntax. The injected payload executes within the plugin database query context, allowing data extraction through error-based, boolean-based, or union-based injection techniques. Refer to the Patchstack WordPress Vulnerability advisory for technical specifics.

Detection Methods for CVE-2025-32127

Indicators of Compromise

HTTP requests to onOffice plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Unexpected database errors logged by WordPress or MySQL referencing plugin query paths
Anomalous outbound database query patterns from the WordPress application user
Authenticated administrator or editor sessions generating bursts of plugin requests with unusual parameter payloads

Detection Strategies

Inspect web server access logs for plugin URLs containing encoded SQL syntax such as %27, %20OR%20, or %20UNION%20
Enable MySQL general query logging on staging environments and review queries originating from the plugin for unparameterized concatenation
Deploy a web application firewall ruleset that flags SQL injection patterns targeting /wp-admin/admin-ajax.php and plugin handlers
Correlate authentication events with subsequent plugin parameter tampering to identify abuse of high-privilege accounts

Monitoring Recommendations

Forward WordPress, PHP, and MySQL logs to a centralized SIEM for query and request inspection
Alert on privileged user sessions that trigger repeated plugin errors or unusual response sizes
Track plugin version inventory across WordPress sites to identify unpatched 5.7 and earlier installations

How to Mitigate CVE-2025-32127

Immediate Actions Required

Identify all WordPress sites running the onoffice-for-wp-websites plugin at version 5.7 or earlier
Update the plugin to the latest vendor release that addresses CVE-2025-32127
Rotate WordPress administrator and editor credentials that may have been used for exploitation
Audit the WordPress database for unexpected user accounts, modified options, or exfiltration indicators

Patch Information

Review the Patchstack advisory for the onOffice for WP-Websites plugin for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin files on disk. Verify the installed version after update.

Workarounds

Restrict access to the WordPress administrative interface using IP allowlists or VPN-gated access
Reduce the number of accounts holding administrator or editor roles to minimize the exploitation surface
Deploy a WAF rule blocking SQL injection patterns targeting the plugin endpoints until patching is complete
Disable the onoffice-for-wp-websites plugin on sites that do not require active onOffice integration

bash

# Configuration example: WP-CLI commands to inventory and update the plugin
wp plugin list --name=onoffice-for-wp-websites --fields=name,status,version
wp plugin update onoffice-for-wp-websites
wp plugin deactivate onoffice-for-wp-websites   # if patch unavailable