CVE-2025-5017: WordPress Catalyst Connect SQLi Vulnerability

CVE-2025-5017 Overview

CVE-2025-5017 is a time-based SQL injection vulnerability in the Catalyst Connect Zoho CRM Client Portal plugin for WordPress. The flaw affects all plugin versions up to and including 2.2.0. It stems from insufficient escaping of the uid parameter and inadequate preparation of the underlying SQL query [CWE-89].

Authenticated attackers with Administrator-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials, session tokens, and CRM client data.

Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database, exposing confidential CRM and user data.

Affected Products

Catalyst Connect Zoho CRM Client Portal plugin for WordPress
All versions up to and including 2.2.0
WordPress sites using the vulnerable plugin with administrator accounts

Discovery Timeline

2026-07-11 - CVE-2025-5017 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-5017

Vulnerability Analysis

The vulnerability resides in the plugin's handling of the uid parameter. The plugin passes user-supplied input directly into an SQL query without proper escaping or parameterization. Because the query lacks a prepared statement structure, attackers can concatenate malicious SQL fragments onto the original query.

This is a time-based blind SQL injection. Attackers infer query results by observing server response delays produced by functions such as SLEEP() or BENCHMARK(). Even without direct output, attackers can extract data one bit at a time.

The issue requires Administrator-level authentication, which limits the attacker population. However, administrator credentials are frequently targeted through phishing, credential stuffing, and session hijacking against WordPress sites.

Root Cause

The root cause is a failure to apply WordPress's $wpdb->prepare() API to the uid parameter before query execution. The plugin also omits input sanitization functions such as sanitize_text_field() or absint(). This combination allows attacker-controlled data to alter the SQL query structure.

Attack Vector

Exploitation occurs over the network against the WordPress admin interface. An authenticated attacker submits a crafted request containing SQL payloads within the uid parameter. The injected payload uses time-delay primitives to enumerate database contents, including the wp_users table containing password hashes and email addresses. Refer to the Wordfence Vulnerability Report and the GitHub SQL Injection Documentation for technical proof-of-concept details.

Detection Methods for CVE-2025-5017

Indicators of Compromise

Unusual HTTP requests to Catalyst Connect Client Portal endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the uid parameter.
Prolonged database query execution times correlating with administrator sessions.
Repeated administrator-authenticated requests to the same endpoint with incrementally varying uid values.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST and GET parameters for SQL injection signatures targeting the uid field.
Enable MySQL slow query logging and alert on queries exceeding baseline execution thresholds from WordPress user sessions.
Monitor WordPress audit logs for administrator accounts making atypical high-frequency requests to plugin endpoints.

Monitoring Recommendations

Correlate authentication events with plugin endpoint access to identify compromised administrator credentials.
Track outbound data volume from the WordPress host for signs of bulk data extraction.
Alert on any modifications to the wp_users or wp_options tables from unexpected sources.

How to Mitigate CVE-2025-5017

Immediate Actions Required

Update the Catalyst Connect Zoho CRM Client Portal plugin to a patched version above 2.2.0 as soon as the vendor releases a fix.
Audit all administrator accounts and rotate credentials, enforcing strong passwords and multi-factor authentication.
Review WordPress and database logs for evidence of prior exploitation attempts against the uid parameter.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 2.2.0. Monitor the WordPress Plugin Information page and the Wordfence Vulnerability Report for updates on patched releases.

Workarounds

Temporarily deactivate the Catalyst Connect Zoho CRM Client Portal plugin until a patched version is available.
Restrict administrator dashboard access by IP allowlisting through the web server or reverse proxy configuration.
Deploy a WAF ruleset that blocks SQL injection payloads targeting WordPress plugin parameters.

bash

# Example WAF rule (ModSecurity) blocking SQL injection in uid parameter
SecRule ARGS:uid "@rx (?i)(sleep|benchmark|union|select|;--|/\*)" \
    "id:1005017,phase:2,deny,status:403,\
    msg:'CVE-2025-5017 - SQL Injection attempt in uid parameter'"