CVE-2025-32687 Overview
CVE-2025-32687 is a SQL Injection vulnerability in the Magnigenie Review Stars Count For WooCommerce plugin for WordPress. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. It affects all plugin versions up to and including 2.0. An authenticated attacker with low privileges can inject arbitrary SQL statements through vulnerable plugin parameters. Successful exploitation can lead to disclosure of sensitive database contents and partial impact to availability, with scope change extending impact beyond the affected component.
Critical Impact
Authenticated attackers can extract sensitive WooCommerce data, including customer and order information, by injecting SQL queries against the WordPress database.
Affected Products
- Magnigenie Review Stars Count For WooCommerce plugin for WordPress
- All versions from n/a through 2.0
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2025-04-10 - CVE CVE-2025-32687 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-32687
Vulnerability Analysis
The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The Review Stars Count For WooCommerce plugin fails to sanitize user-supplied input before incorporating it into SQL queries executed against the WordPress database. Attackers can manipulate query logic by injecting crafted SQL syntax into vulnerable parameters.
The issue affects every plugin release through version 2.0. Because the scope is changed, exploitation can affect resources beyond the plugin itself, including data stored in other WooCommerce tables.
Root Cause
The root cause is the absence of proper input validation and parameterized queries when handling user-controlled data passed to database query functions. Instead of using prepared statements via $wpdb->prepare(), the plugin concatenates untrusted input directly into SQL strings.
Attack Vector
The attack is network-based and requires low-privilege authentication. An attacker with a valid account on the WordPress site sends crafted HTTP requests containing SQL payloads to plugin endpoints. The injected SQL executes within the database context of the WordPress installation, allowing UNION-based or boolean-based extraction of arbitrary table data such as wp_users, wp_usermeta, and WooCommerce order tables.
No public proof-of-concept exploit is available at the time of writing. See the Patchstack WooCommerce SQL Injection Advisory for additional technical details.
Detection Methods for CVE-2025-32687
Indicators of Compromise
- HTTP requests to Review Stars Count For WooCommerce endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
- Unexpected database errors logged by WordPress or MySQL referencing plugin query paths
- Anomalous read activity against wp_users, wp_usermeta, or WooCommerce order tables originating from web sessions
- Authenticated user accounts issuing high volumes of requests to plugin AJAX or REST endpoints
Detection Strategies
- Inspect web server access logs for requests to plugin URIs containing URL-encoded SQL syntax
- Enable MySQL general query logging on staging environments to identify malformed queries originating from the plugin
- Deploy a Web Application Firewall (WAF) rule set targeting WordPress SQL injection patterns
- Correlate authenticated user activity with database error spikes to identify probing behavior
Monitoring Recommendations
- Monitor for spikes in 500-series HTTP responses from plugin endpoints, which can indicate failed injection attempts
- Alert on outbound database response sizes that exceed normal baselines for plugin requests
- Track creation of new administrator accounts following plugin endpoint activity
- Audit WordPress user role changes that occur shortly after suspicious plugin requests
How to Mitigate CVE-2025-32687
Immediate Actions Required
- Identify all WordPress installations running Review Stars Count For WooCommerce version 2.0 or earlier
- Deactivate and remove the plugin until a patched release is verified and installed
- Rotate WordPress administrator and database credentials if exploitation is suspected
- Review WooCommerce customer and order data for signs of unauthorized access or exfiltration
Patch Information
At the time of NVD publication, no fixed version is identified in the advisory. Site administrators should monitor the Patchstack WooCommerce SQL Injection Advisory and the plugin vendor for an official update beyond version 2.0.
Workarounds
- Remove the plugin entirely if a patched version is not yet available
- Restrict access to WordPress authenticated endpoints using IP allowlisting where feasible
- Deploy WAF rules that block common SQL injection payloads targeting WordPress plugin parameters
- Apply the principle of least privilege to the WordPress database account, removing unnecessary privileges such as FILE or schema modification rights
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate review-stars-count-for-woocommerce
wp plugin delete review-stars-count-for-woocommerce
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
