CVE-2025-32204: Split Test For Elementor SQLi Vulnerability

CVE-2025-32204 Overview

CVE-2025-32204 is a SQL Injection vulnerability affecting the Split Test For Elementor WordPress plugin developed by rocketelements. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. Attackers with high-privilege access can inject malicious SQL statements through the plugin, altering database queries executed by the WordPress backend. The vulnerability affects all versions of Split Test For Elementor up to and including 1.8.3. The issue carries a CVSS 3.1 base score of 7.6 and results in a changed scope, meaning the impact extends beyond the vulnerable component itself.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing sensitive site content and impacting the availability of affected installations.

Affected Products

Split Test For Elementor plugin (split-test-for-elementor) versions up to and including 1.8.3
WordPress sites running the rocketelements Split Test For Elementor plugin
WordPress installations that grant contributor-level or higher privileges to untrusted users

Discovery Timeline

2025-04-04 - CVE-2025-32204 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32204

Vulnerability Analysis

The vulnerability is a classic SQL Injection issue [CWE-89] in the Split Test For Elementor plugin. User-supplied input is concatenated into SQL statements without adequate sanitization or parameterization. When the plugin processes requests, attacker-controlled values reach the database query layer and modify the intended query structure. The changed scope indicated by the CVSS vector reflects that a successful attack against the plugin can influence resources beyond the plugin itself, including core WordPress tables. Confidentiality impact is high, while integrity is not affected and availability impact is low.

Root Cause

The root cause is the plugin's failure to use prepared statements or the WordPress $wpdb->prepare() API when constructing SQL queries from request parameters. Special characters such as single quotes, semicolons, and SQL keywords pass through to the query engine unescaped. This allows an authenticated user to break out of the intended query context and append additional SQL clauses.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with elevated privileges. The attacker submits a crafted HTTP request to a plugin endpoint that accepts parameters used within a SQL statement. Because no user interaction is required beyond the attacker's own request, the injection can be automated once valid credentials are obtained. Vulnerable versions include all releases through 1.8.3. Refer to the Patchstack SQL Injection Advisory for advisory-level technical detail. No public proof-of-concept exploit code has been verified for this CVE at the time of publication.

Detection Methods for CVE-2025-32204

Indicators of Compromise

Unusual SQL syntax such as UNION SELECT, SLEEP(, --, or INFORMATION_SCHEMA appearing in web server request logs targeting plugin endpoints
Unexpected outbound queries or long-running database processes originating from the WordPress PHP workers
Newly created administrator accounts or modified wp_options values following requests to Split Test For Elementor URLs
Presence of the split-test-for-elementor plugin at version 1.8.3 or earlier within wp-content/plugins/

Detection Strategies

Enable WordPress debug logging and correlate database errors with authenticated user sessions for the plugin
Deploy a web application firewall ruleset that inspects requests to /wp-admin/admin-ajax.php and plugin-specific endpoints for SQL metacharacters
Monitor MySQL general query logs for queries containing unusual boolean expressions or stacked statements originating from plugin code paths

Monitoring Recommendations

Alert on repeated 500-level responses from plugin endpoints, which may indicate injection probing
Track privilege changes and creation of new users within the WordPress database after suspicious requests
Baseline normal request volumes to plugin URLs and flag deviations, particularly from authenticated but low-reputation accounts

How to Mitigate CVE-2025-32204

Immediate Actions Required

Identify all WordPress installations using the Split Test For Elementor plugin and confirm the installed version
Disable or remove the plugin on any site running version 1.8.3 or earlier until a fixed release is applied
Restrict administrative and contributor access to trusted users only, and rotate credentials for accounts that may have been exposed
Audit database contents and user tables for unauthorized modifications

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack lists all versions through 1.8.3 as affected. Site operators should consult the Patchstack SQL Injection Advisory and the WordPress plugin repository for the latest fixed release, and update immediately once available.

Workarounds

Deactivate the Split Test For Elementor plugin until an updated version is installed
Apply virtual patching through a web application firewall to block SQL metacharacters in requests to plugin endpoints
Enforce the principle of least privilege for WordPress roles to reduce the pool of accounts capable of triggering the vulnerable code path
Restrict access to /wp-admin/ via IP allowlisting where feasible

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate split-test-for-elementor
wp plugin status split-test-for-elementor