CVE-2025-5563: WP-Addpub WordPress Plugin SQLi Vulnerability

CVE-2025-5563 Overview

CVE-2025-5563 is a SQL Injection vulnerability in the WP-Addpub plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.2.8. The vulnerability exists in the wp-addpub shortcode handler, which fails to properly escape user-supplied input and does not use prepared SQL statements. Authenticated attackers holding Contributor-level access or higher can append additional SQL queries to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials, session tokens, and configuration data.

Critical Impact

Authenticated Contributor-level users can perform SQL injection through the wp-addpub shortcode to exfiltrate arbitrary data from the WordPress database.

Affected Products

• WordPress WP-Addpub plugin versions 1.2.8 and earlier
• WordPress sites permitting Contributor-level or higher user registration
• Any WordPress installation with the WP-Addpub plugin activated

Discovery Timeline

• 2025-06-06 - CVE-2025-5563 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5563

Vulnerability Analysis

The WP-Addpub plugin exposes a shortcode named wp-addpub that processes user-supplied parameters and passes them into a SQL query. The plugin performs the query without adequate escaping and without using WordPress prepared-statement APIs such as $wpdb->prepare(). This design allows an attacker to break out of the intended query context.

An attacker with Contributor privileges can embed the vulnerable shortcode inside post or page content. When the shortcode renders, the malicious parameter is concatenated into the SQL query and executed against the WordPress database. The vulnerability falls under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is missing input sanitization combined with unsafe query construction in the shortcode handler. Source code inspection of the plugin at wp-addpub.php line 57 and wp-addpub.php line 541 shows shortcode attributes flowing directly into a SQL query string without parameter binding.

Attack Vector

The attack requires authenticated access with Contributor privileges or higher. The attacker creates a draft post containing the wp-addpub shortcode with a crafted attribute value that includes a UNION-based or stacked SQL payload. When the post is previewed or published and the shortcode is rendered, the injected SQL executes with the database user's privileges. See the Wordfence Vulnerability Report for additional context.

The vulnerability manifests as unsanitized concatenation of shortcode attribute values into a SELECT query executed via $wpdb->get_results(). No exploitation code is included here; refer to the vendor code references above for the vulnerable function context.

Detection Methods for CVE-2025-5563

Indicators of Compromise

• Unusual wp-addpub shortcodes containing SQL syntax such as UNION SELECT, --, #, or /* in post content or post revisions
• Database queries in slow query logs referencing wp_users or wp_usermeta tables originating from post render operations
• New or modified draft posts authored by low-privilege Contributor accounts containing the vulnerable shortcode
• Unexpected outbound traffic from the web server following post preview requests

Detection Strategies

• Audit all posts and post revisions for occurrences of the [wp-addpub] shortcode with suspicious attribute values
• Enable MySQL general query logging temporarily to identify SQL patterns consistent with UNION-based injection
• Deploy a Web Application Firewall rule to flag SQL keywords appearing in shortcode attributes on WordPress endpoints
• Review WordPress access logs for repeated preview=true requests from Contributor accounts

Monitoring Recommendations

• Alert on new user registrations that reach Contributor role or higher, particularly on sites with open registration
• Monitor plugin file integrity to confirm the vulnerable wp-addpub.php version in use
• Track database query volume and error rates from the WordPress PHP process for anomalies

How to Mitigate CVE-2025-5563

Immediate Actions Required

• Deactivate the WP-Addpub plugin until a patched version is confirmed available
• Audit existing user accounts and remove or downgrade untrusted Contributor-level and above accounts
• Restrict new user registration or set the default role to Subscriber in WordPress Settings
• Rotate WordPress administrator credentials and secret keys defined in wp-config.php if compromise is suspected

Patch Information

At the time of NVD publication, all versions up to and including 1.2.8 are affected. Review the Wordfence Vulnerability Report and the WordPress plugin repository for updates and a fixed release.

Workarounds

• Remove the WP-Addpub plugin entirely if it is not business-critical
• Deploy a WAF rule blocking SQL metacharacters in shortcode attribute values on POST and preview requests
• Restrict shortcode usage for Contributor accounts via a custom filter that strips [wp-addpub] from unpublished content
• Enforce least-privilege role assignment and review user roles quarterly

# Disable the plugin via WP-CLI as an immediate mitigation
wp plugin deactivate wp-addpub

# Optionally remove the plugin from the filesystem
wp plugin uninstall wp-addpub

# Change default new-user role to Subscriber
wp option update default_role subscriber