CVE-2025-32301: CountDown Pro WP Plugin SQL Injection Flaw

CVE-2025-32301 Overview

CVE-2025-32301 is a SQL injection vulnerability in the LambertGroup CountDown Pro WP Plugin for WordPress. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. It affects all plugin versions up to and including 2.7. An authenticated attacker with low privileges can inject crafted SQL statements through the circular_countdown component over the network. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the vulnerable component itself. Patchstack published the advisory tracking this issue.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing sensitive content stored across the site.

Affected Products

LambertGroup CountDown Pro WP Plugin versions up to and including 2.7
WordPress sites using the circular_countdown component
Any WordPress deployment with the vulnerable plugin active

Discovery Timeline

2025-05-16 - CVE-2025-32301 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32301

Vulnerability Analysis

The vulnerability resides in the circular_countdown functionality of the CountDown Pro WP Plugin. User-supplied input flows into SQL query construction without proper sanitization or parameterization. An attacker with at least low-privilege authenticated access can submit crafted parameters that alter query logic. Because the issue results in scope change, injected SQL can reach data and components beyond the plugin's direct boundary.

The primary impact is confidentiality, with high disclosure potential, alongside limited availability impact. Integrity impact is rated as none in the assigned vector. Successful exploitation can return database contents to the attacker through query manipulation or blind extraction techniques.

Root Cause

The root cause is the absence of parameterized queries or proper escaping in the circular_countdown request handler. WordPress provides $wpdb->prepare() for safe query construction, but the plugin concatenates untrusted input directly into SQL statements. This pattern matches the [CWE-89] weakness class for SQL injection.

Attack Vector

The attack is remote and requires network reachability to the WordPress site. The attacker must hold valid low-privilege credentials, such as a Subscriber or Contributor account. No user interaction is needed. The attacker sends crafted HTTP requests to the plugin endpoint with malicious SQL fragments embedded in vulnerable parameters. EPSS data lists exploitation probability at 0.267%.

The vulnerability is described in prose only. See the Patchstack SQL Injection Report for technical specifics.

Detection Methods for CVE-2025-32301

Indicators of Compromise

HTTP requests to plugin endpoints containing SQL meta-characters such as ', --, UNION SELECT, or SLEEP(
Unexpected database errors in PHP error logs referencing the circular_countdown plugin path
Authentication events from low-privilege accounts immediately followed by anomalous query patterns
Outbound responses containing database schema fragments or wp_users content

Detection Strategies

Inspect web server access logs for parameter values containing encoded SQL syntax targeting plugin routes
Enable WordPress query logging and alert on queries originating from the plugin that include UNION, INFORMATION_SCHEMA, or stacked statements
Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin parameters
Correlate authenticated session activity with database error spikes

Monitoring Recommendations

Monitor for low-privilege user accounts issuing requests to plugin admin-ajax or REST endpoints
Track creation of new administrative users or modification of wp_options records following plugin requests
Alert on unusual database read volumes from the WordPress application user

How to Mitigate CVE-2025-32301

Immediate Actions Required

Deactivate the CountDown Pro WP Plugin until a patched release is confirmed installed
Audit existing WordPress accounts and revoke unnecessary low-privilege access
Review database logs for evidence of injection attempts targeting the plugin
Rotate WordPress secret keys and administrative credentials if compromise is suspected

Patch Information

No fixed version is listed in the available advisory. The vulnerability affects all releases through 2.7. Monitor the Patchstack advisory and the LambertGroup vendor channel for an updated build that addresses the SQL injection in circular_countdown.

Workarounds

Restrict access to the plugin endpoints via web server rules until a patch is available
Apply virtual patching through a WAF ruleset that blocks SQL meta-characters in plugin parameters
Limit WordPress database user permissions so the application account cannot read sensitive tables beyond what the site requires
Disable user self-registration to reduce the pool of low-privilege accounts available to attackers

bash

# Example WAF rule to block SQL meta-characters on plugin parameters
SecRule ARGS_NAMES "@rx circular_countdown" \
    "id:1003201,phase:2,deny,status:403,\
     msg:'Block suspected SQLi on CountDown Pro WP Plugin',\
     chain"
    SecRule ARGS "@rx (?i)(union(\s|/\*).*select|sleep\(|information_schema|--\s|;\s*drop)" \
        "t:none,t:urlDecodeUni"