CVE-2025-58789: WP Full Stripe Free SQL Injection Flaw

CVE-2025-58789 Overview

CVE-2025-58789 is a SQL Injection vulnerability in the Themeisle WP Full Stripe Free WordPress plugin. The flaw affects all versions of wp-full-stripe-free up to and including 8.2.5. Attackers with high privileges can inject malicious SQL statements through unsanitized input passed to database queries. The issue is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Successful exploitation can disclose sensitive WordPress data and impact application availability across the affected scope.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing confidential records and potentially affecting other tenants on shared hosting deployments.

Affected Products

Themeisle WP Full Stripe Free plugin for WordPress
All versions from n/a through 8.2.5 of wp-full-stripe-free
WordPress sites that have the vulnerable plugin installed and activated

Discovery Timeline

2025-09-05 - CVE-2025-58789 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-58789

Vulnerability Analysis

The WP Full Stripe Free plugin fails to properly neutralize special characters in SQL commands. User-controlled input is concatenated into database queries without parameterization or adequate escaping. This allows an attacker with high privileges to alter query logic and execute arbitrary SQL through the plugin's request handlers.

The vulnerability requires authenticated access with elevated privileges but no user interaction. The scope is marked as changed, meaning the impact can extend beyond the vulnerable component into the broader WordPress installation and underlying database. Confidentiality impact is high, while integrity is unaffected and availability is partially affected.

Root Cause

The root cause is insufficient input sanitization on parameters that flow into SQL statements within the plugin. Instead of using WordPress prepared statement APIs such as $wpdb->prepare() with placeholders, the code paths concatenate untrusted values directly into queries. This pattern enables operators like UNION SELECT or stacked clauses to modify the intended query.

Attack Vector

The attack is delivered over the network through HTTP requests to plugin endpoints. An authenticated user with high privileges submits crafted parameters containing SQL meta-characters. The plugin passes those values into a database query, where the injected payload is parsed and executed by the SQL engine.

No verified public exploit code is available at this time. Refer to the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2025-58789

Indicators of Compromise

HTTP requests to wp-admin/admin.php or plugin AJAX endpoints containing SQL meta-characters such as UNION, SLEEP(, --, or /*
Unexpected outbound database queries originating from privileged WordPress user accounts
Anomalous response times on plugin endpoints, indicating time-based blind SQL injection probing
WordPress audit log entries showing administrative actions from accounts that normally do not invoke wp-full-stripe-free functions

Detection Strategies

Inspect web server access logs for plugin URLs carrying encoded SQL syntax in query parameters or POST bodies
Enable WordPress query logging or use SAVEQUERIES in development environments to identify malformed prepared statements
Deploy a web application firewall ruleset that flags SQL injection patterns against /wp-content/plugins/wp-full-stripe-free/ paths

Monitoring Recommendations

Alert on elevated error rates from the WordPress database driver, especially syntax errors tied to plugin requests
Monitor for newly created administrator accounts or modified user metadata after suspicious requests
Track outbound traffic from the web server to detect data exfiltration following successful injection

How to Mitigate CVE-2025-58789

Immediate Actions Required

Update WP Full Stripe Free to a version newer than 8.2.5 as soon as the vendor publishes a fixed release
Restrict access to the WordPress administrative interface using IP allowlists or VPN gating
Rotate WordPress administrator credentials and review accounts with high privileges for unauthorized changes
Audit the wp_users, wp_usermeta, and plugin-specific tables for signs of tampering

Patch Information

Review the Patchstack SQL Injection Advisory for the fixed version and remediation status. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Deactivate and remove the WP Full Stripe Free plugin until a patched version is deployed
Apply a virtual patch using a WAF rule that blocks SQL keywords in requests to plugin endpoints
Limit the number of accounts holding administrator or editor roles to reduce the population that can trigger the vulnerable code path

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-full-stripe-free
wp plugin delete wp-full-stripe-free