CVE-2025-4964: WP Online Users Stats SQL Injection Flaw

CVE-2025-4964 Overview

CVE-2025-4964 is a time-based SQL injection vulnerability [CWE-89] in the WP Online Users Stats plugin for WordPress. The flaw affects all versions up to and including 1.0.0. It exists in the handling of the table_name parameter, which lacks sufficient escaping and proper query preparation. Authenticated attackers with Editor-level access or higher can append arbitrary SQL to existing queries. Successful exploitation allows extraction of sensitive data from the underlying WordPress database.

Critical Impact

Authenticated Editor-level users can execute time-based SQL injection against the WordPress database and exfiltrate sensitive information such as user credentials, session tokens, and configuration data.

Affected Products

• WP Online Users Stats plugin for WordPress (vendor hk1993)
• All versions up to and including 1.0.0
• WordPress installations with the plugin activated and Editor-or-above accounts

Discovery Timeline

• 2025-06-06 - CVE-2025-4964 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4964

Vulnerability Analysis

The vulnerability is a time-based SQL injection in the plugin's administrative code path referenced at admin/class-wp-online-users-stats-admin.php line 118. The table_name request parameter is concatenated into an SQL query without adequate escaping or use of prepared statements. Because the input is trusted, an attacker can append SQL fragments such as conditional SLEEP() calls to infer data one bit at a time based on server response latency. Authentication is required, and the attacker must hold Editor-level privileges or higher, limiting exposure to sites that grant such roles to untrusted accounts or where lower-privileged accounts have been compromised. Impact is confined to confidentiality; the CVSS vector indicates no direct integrity or availability effect.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin passes the table_name value into a query without wrapping it in $wpdb->prepare() or validating it against a strict allow-list of table identifiers. WordPress table and identifier names cannot be parameterized through %s placeholders directly, which requires developers to validate them against a known list before interpolation. That validation is absent here.

Attack Vector

Exploitation occurs over the network against the WordPress admin interface. The attacker authenticates as an Editor or higher, then issues a crafted request that supplies a malicious table_name value. The injected payload extends the existing query with time-delay primitives, letting the attacker perform blind data extraction against tables such as wp_users and wp_usermeta. See the WordPress Plugin Code Review and Wordfence Vulnerability Analysis for technical context.

Detection Methods for CVE-2025-4964

Indicators of Compromise

• Admin-originated HTTP requests containing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, or encoded variants inside the table_name parameter.
• Unusually long response times on plugin administrative endpoints correlated with a single authenticated session.
• Elevated database read activity against wp_users, wp_usermeta, or wp_options from the web application user.

Detection Strategies

• Enable WordPress and web server access logging, then alert on table_name values that contain non-alphanumeric characters or SQL syntax.
• Deploy a web application firewall rule that inspects requests to the WP Online Users Stats admin endpoints for SQL metacharacters.
• Correlate authenticated Editor sessions with database slow-query logs to surface time-based injection attempts.

Monitoring Recommendations

• Monitor for repeated failed or delayed admin requests originating from the same session or IP address.
• Track new or unexpected Editor and Administrator account creation across WordPress sites.
• Review MySQL general or slow query logs for repeated SLEEP() or BENCHMARK() patterns tied to plugin queries.

How to Mitigate CVE-2025-4964

Immediate Actions Required

• Deactivate and remove the WP Online Users Stats plugin until a fixed version is confirmed available.
• Audit WordPress accounts and revoke Editor or higher privileges from users that do not require them.
• Rotate WordPress administrator passwords, secret keys in wp-config.php, and any database credentials that may have been exposed.

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor patch is referenced in the advisory. Consult the WordPress Plugin Developer Resources page for release status and the Wordfence Vulnerability Analysis entry for updated remediation guidance.

Workarounds

• Restrict access to WordPress admin paths (/wp-admin/) by IP allow-list at the reverse proxy or firewall.
• Enforce multi-factor authentication for all accounts with Editor privileges or higher to reduce risk of credential-based access.
• Configure a web application firewall to block requests where the table_name parameter contains characters outside [A-Za-z0-9_].

# Example WAF rule (ModSecurity) blocking suspicious table_name values
SecRule ARGS:table_name "!@rx ^[A-Za-z0-9_]+$" \
    "id:1004964,phase:2,deny,status:403,\
     msg:'CVE-2025-4964 WP Online Users Stats SQLi attempt',\
     tag:'CWE-89'"