CVE-2025-49404: Listeo Core SQL Injection Vulnerability

CVE-2025-49404 Overview

CVE-2025-49404 is a SQL Injection vulnerability in the Listeo Core WordPress plugin developed by purethemes. The flaw affects all versions up to and including 2.0.7. Authenticated attackers with low privileges can inject malicious SQL statements through unsanitized input parameters processed by the plugin. The vulnerability is tracked under CWE-89 and stems from improper neutralization of special elements used in SQL commands. Successful exploitation can expose sensitive database contents and impact the integrity of WordPress sites running the affected plugin.

Critical Impact
Authenticated attackers can extract sensitive data from the WordPress database and potentially affect site availability through crafted SQL payloads sent over the network.

Affected Products

purethemes Listeo Core plugin versions through 2.0.7
WordPress sites running the Listeo theme ecosystem with Listeo Core enabled
Listings, bookings, and user data stored in the WordPress MySQL/MariaDB database

Discovery Timeline

2025-08-28 - CVE-2025-49404 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49404

Vulnerability Analysis

The Listeo Core plugin fails to properly neutralize special characters supplied through user-controlled parameters before incorporating them into SQL queries. An authenticated attacker can craft input containing SQL syntax that breaks out of the intended query context. The resulting query executes attacker-controlled logic against the WordPress database backend.

The attack vector is network-based and requires only low-privilege authentication. The scope is changed, indicating that the impact extends beyond the security boundary of the vulnerable component to other database resources. Confidentiality impact is high because attackers can read arbitrary database tables, including user credentials, session tokens, and personally identifiable information stored by Listeo listings.

Root Cause

The root cause is missing parameterization in database queries within the listeo-core plugin code. User-supplied values reach SQL statements without passing through wpdb->prepare() or equivalent sanitization functions. Without prepared statements, special characters such as single quotes, semicolons, and SQL keywords are interpreted as query syntax rather than literal data.

Attack Vector

An attacker authenticates to the WordPress site with any role that exposes the vulnerable plugin endpoint. The attacker submits a request containing a SQL injection payload in a parameter consumed by Listeo Core. The plugin concatenates the payload directly into a query, allowing UNION-based extraction, boolean-based blind injection, or time-based blind injection techniques. Refer to the Patchstack Vulnerability Report for additional technical context.

No verified public exploit code is available for CVE-2025-49404 at this time. The EPSS probability is 0.251%, placing the CVE in the 16.295 percentile for likelihood of exploitation in the next 30 days.

Detection Methods for CVE-2025-49404

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, OR 1=1, or encoded equivalents in HTTP request parameters targeting Listeo Core endpoints
Unusual database query latency or error responses returned to authenticated low-privilege users
Outbound data transfers from the web server immediately following requests to /wp-admin/admin-ajax.php actions registered by listeo-core
New or modified WordPress administrator accounts not created by legitimate workflows

Detection Strategies

Inspect web server access logs for authenticated requests to Listeo Core endpoints containing SQL metacharacters or URL-encoded SQL keywords
Enable MySQL general query logging on a temporary basis to identify malformed or unusually structured queries originating from the WordPress process
Deploy a Web Application Firewall (WAF) ruleset that flags SQL injection patterns scoped to the plugin's request paths

Monitoring Recommendations

Monitor the wp_users and wp_usermeta tables for unauthorized modifications and privilege changes
Alert on bursts of authenticated requests to Listeo Core AJAX actions from a single session or IP address
Forward WordPress and database logs to a centralized analytics platform to correlate suspicious query patterns with user sessions

How to Mitigate CVE-2025-49404

Immediate Actions Required

Update the Listeo Core plugin to a version later than 2.0.7 as soon as a patched release is available from purethemes
Audit all WordPress accounts and remove unused low-privilege users that could be leveraged for authenticated exploitation
Rotate database credentials and WordPress secret keys in wp-config.php if compromise is suspected
Review the WordPress database for unauthorized records, modified content, or exfiltration indicators

Patch Information

Purethemes addresses the issue in releases following Listeo Core 2.0.7. Consult the Patchstack Vulnerability Report and the official purethemes changelog for the fixed version. Apply the update in a staging environment before promoting to production.

Workarounds

Restrict access to Listeo Core endpoints via WAF rules until the plugin is updated
Temporarily disable user registration or limit registrations to trusted email domains to reduce the pool of authenticated attackers
Deploy virtual patching through a WAF or Patchstack to block known SQL injection signatures targeting listeo-core

bash

# Example WAF rule snippet to block SQL keywords in Listeo Core requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1004940,msg:'Listeo Core SQLi attempt'"
SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|or\s+1=1)" \
  "t:none,t:urlDecodeUni"