CVE-2025-60108 Overview
CVE-2025-60108 is a blind SQL injection vulnerability in the LambertGroup AllInOne - Banner with Thumbnails WordPress plugin. The flaw affects all plugin versions up to and including 3.8. Authenticated attackers with low privileges can inject malicious SQL statements through unsanitized input parameters processed by the plugin. The vulnerability is classified under CWE-89 for improper neutralization of special elements used in SQL commands. Successful exploitation can expose database contents and impact application availability through scope-changing attacks on the underlying WordPress database.
Critical Impact
Authenticated attackers can extract sensitive WordPress database contents, including user credentials and configuration secrets, through blind SQL injection requests sent over the network.
Affected Products
- LambertGroup AllInOne - Banner with Thumbnails plugin versions through 3.8
- WordPress sites running the all-in-one-thumbnailsBanner plugin
- Any WordPress deployment where the affected plugin is installed and active
Discovery Timeline
- 2025-09-26 - CVE-2025-60108 published to the National Vulnerability Database
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-60108
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-supplied input passed into SQL queries within the all-in-one-thumbnailsBanner plugin. The plugin concatenates request parameters directly into database queries without parameterized statements or input sanitization. Attackers craft payloads containing SQL syntax that the database engine interprets as part of the query structure rather than data.
The injection is blind, meaning the application does not return database errors or query output directly. Attackers infer data through boolean conditions or time-based delays. This technique allows extraction of arbitrary database contents one bit at a time through repeated requests.
The attack requires low-privilege authentication, meaning any registered user account, including subscriber-level accounts, may suffice. The scope-changing nature of the flaw allows the injected SQL to impact resources beyond the plugin itself, including the broader WordPress database schema.
Root Cause
The root cause is the absence of prepared statements when constructing SQL queries from request parameters. The plugin does not invoke WordPress core sanitization functions such as $wpdb->prepare() or esc_sql() before passing values to the database layer. This omission allows special characters such as single quotes, parentheses, and SQL keywords to alter query semantics.
Attack Vector
An authenticated attacker submits a crafted HTTP request to a vulnerable plugin endpoint. The request contains SQL metacharacters in a parameter that the plugin uses in a database query. The database evaluates the injected payload, and the attacker observes differential responses to enumerate schema and exfiltrate data.
No verified proof-of-concept code is publicly available. Refer to the Patchstack Plugin Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-60108
Indicators of Compromise
- HTTP requests to plugin endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, BENCHMARK(, or stacked ; statements
- Repeated authenticated requests from a single session with incrementing payload variations characteristic of blind injection enumeration
- Unusual database query latency or spikes in wpdb error log entries referencing the all-in-one-thumbnailsBanner plugin
Detection Strategies
- Inspect web server access logs for parameter values containing encoded SQL syntax targeting /wp-admin/admin-ajax.php or plugin-specific endpoints
- Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin parameters
- Enable MySQL general query logging in non-production environments to identify malformed queries originating from the plugin
Monitoring Recommendations
- Alert on authenticated low-privilege accounts generating high request volumes against banner plugin endpoints
- Monitor for time-based response anomalies, particularly responses exceeding baseline by intervals consistent with SLEEP() payloads
- Track new or modified WordPress user accounts and option table changes following suspicious request patterns
How to Mitigate CVE-2025-60108
Immediate Actions Required
- Deactivate the LambertGroup AllInOne - Banner with Thumbnails plugin until a patched version is confirmed available from the vendor
- Audit WordPress user accounts and remove unnecessary low-privilege accounts that could be leveraged for authenticated exploitation
- Rotate WordPress administrator credentials and database secrets stored in wp-config.php if compromise is suspected
Patch Information
No fixed version is identified in the published CVE record. The vulnerability affects versions through 3.8 with no patched release listed. Monitor the Patchstack advisory and the LambertGroup vendor page for patch availability.
Workarounds
- Restrict access to plugin endpoints using web server access control rules limiting requests to administrative IP ranges
- Deploy WAF virtual patching rules that block SQL syntax in parameters submitted to the plugin
- Replace the plugin with an alternative banner solution from a vendor providing an active security update channel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
