CVE-2025-3436 Overview
CVE-2025-3436 is a SQL injection vulnerability in the coreActivity: Activity Logging plugin for WordPress. The flaw affects all versions up to and including 2.7. It stems from insufficient escaping of user-supplied values in the order and orderby parameters combined with inadequate query preparation. Authenticated users with Subscriber-level access or above can append additional SQL clauses to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database. The vulnerability is tracked under CWE-89: SQL Injection.
Critical Impact
Authenticated attackers with only Subscriber privileges can execute crafted SQL queries against the WordPress database and exfiltrate confidential information such as user records, session data, and configuration secrets.
Affected Products
- coreActivity: Activity Logging for WordPress plugin, versions up to and including 2.7
- WordPress installations with the vulnerable plugin active
- Any site permitting Subscriber-level account registration alongside the plugin
Discovery Timeline
- 2025-04-08 - CVE-2025-3436 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3436
Vulnerability Analysis
The vulnerability resides in the plugin's live activity table handler, specifically in the code path that processes ordering parameters for the activity log display. The plugin accepts the order and orderby request parameters and interpolates them directly into a SQL statement without applying an allow-list of valid column names or sort directions. Because these values are used to build the ORDER BY clause, standard wpdb::prepare() placeholders are not applied, and the input reaches the database engine unchanged.
An attacker authenticated as a Subscriber can send crafted values that break out of the intended clause and append arbitrary SQL. This class of flaw commonly enables UNION-based data extraction and time-based blind exfiltration through subqueries in the sort expression. The fix committed in changeset 3259839 addresses the issue in core/table/Live.php.
Root Cause
The root cause is missing input validation on ordering parameters and reliance on string concatenation to build the SQL statement. WordPress documentation explicitly warns that column identifiers and sort directions cannot be parameterized and must be validated against a fixed set of allowed values. The plugin omitted this check.
Attack Vector
Exploitation requires network access to the WordPress admin-ajax or listing endpoint that renders the coreActivity log, along with a valid Subscriber account. The attacker submits a request that includes malicious payloads in the order or orderby parameter. The server executes the resulting query, and returned rows or timing differences reveal database contents. No user interaction beyond the attacker's own request is required.
Refer to the Wordfence Vulnerability Report for technical details on the parameter handling.
Detection Methods for CVE-2025-3436
Indicators of Compromise
- HTTP requests to WordPress endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside the order or orderby parameters.
- Unusual ORDER BY clauses in MySQL general or slow query logs originating from the WordPress database user.
- Subscriber accounts issuing repeated requests to plugin listing endpoints in short intervals.
- Elevated database response times correlated with requests from low-privilege authenticated users.
Detection Strategies
- Inspect WordPress access logs for authenticated requests carrying non-alphanumeric characters in order or orderby values.
- Enable MySQL query logging and alert on queries containing subselects or sleep functions inside ORDER BY clauses.
- Deploy a web application firewall rule that blocks SQL metacharacters in ordering parameters targeting /wp-admin/ and admin-ajax.php.
Monitoring Recommendations
- Track new Subscriber registrations and correlate account creation timestamps with subsequent access to plugin-managed pages.
- Baseline normal query patterns for the WordPress database and alert on statements referencing wp_users or wp_usermeta from unexpected code paths.
- Forward WordPress and web server logs to a centralized analytics platform for retrospective hunting against the payload patterns above.
How to Mitigate CVE-2025-3436
Immediate Actions Required
- Update the coreActivity: Activity Logging plugin to a version later than 2.7 that includes the fix from changeset 3259839.
- Audit existing user accounts and remove unused Subscriber-level accounts, particularly those created since the plugin was installed.
- Rotate WordPress secret keys, administrator passwords, and any credentials stored in wp_options if exploitation is suspected.
- Review the WordPress database for unauthorized modifications to user, options, and session tables.
Patch Information
The vendor addressed the vulnerability in core/table/Live.php by validating the order and orderby parameters before use in the SQL query. Site operators should install the patched plugin release through the WordPress plugin manager or WP-CLI. Verify installation by confirming the plugin version reported in the WordPress dashboard is greater than 2.7.
Workarounds
- Disable the coreActivity: Activity Logging plugin until the patched version can be installed.
- Restrict self-service user registration or set the default new-user role to a value that removes access to the affected endpoints.
- Configure a web application firewall to reject requests where order or orderby parameters contain characters outside [A-Za-z0-9_] or values other than ASC and DESC.
# Update the vulnerable plugin using WP-CLI
wp plugin update coreactivity
# Verify the installed version
wp plugin get coreactivity --field=version
# Temporarily deactivate the plugin if a patch cannot be applied
wp plugin deactivate coreactivity
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
