CVE-2025-60110 Overview
CVE-2025-60110 is a SQL Injection vulnerability [CWE-89] in the LambertGroup AllInOne Banner Rotator plugin for WordPress. The flaw stems from improper neutralization of special elements used in an SQL command. Attackers with low-privilege authenticated access can inject malicious SQL statements through the affected plugin endpoints. The vulnerability affects all versions of all-in-one-bannerRotator up to and including version 3.8. Exploitation requires no user interaction and can be performed over the network.
Critical Impact
Authenticated attackers can extract sensitive database contents, including WordPress user credentials and session tokens, by injecting crafted SQL payloads into vulnerable plugin parameters.
Affected Products
- LambertGroup AllInOne Banner Rotator plugin versions through 3.8
- WordPress installations running the all-in-one-bannerRotator plugin
- Any site exposing the vulnerable plugin endpoints to authenticated users
Discovery Timeline
- 2025-09-26 - CVE-2025-60110 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-60110
Vulnerability Analysis
The vulnerability resides in the LambertGroup AllInOne Banner Rotator plugin, which fails to properly sanitize user-supplied input before incorporating it into SQL queries. An attacker holding a low-privileged WordPress account can submit crafted parameter values that break out of the intended query context. The injected SQL executes against the WordPress database with the privileges of the plugin's database connection.
The scope change indicated in the CVSS vector reflects that successful exploitation impacts resources beyond the plugin itself, reaching shared WordPress database tables. Confidentiality impact is high because attackers can read arbitrary tables, including wp_users and wp_usermeta. Availability impact is limited, but data manipulation paths may exist depending on the injection point.
Root Cause
The root cause is the absence of parameterized queries or proper escaping when handling user input. The plugin concatenates request parameters directly into SQL statements rather than using prepared statements via $wpdb->prepare(). This pattern violates the WordPress secure coding guidelines for database access [CWE-89].
Attack Vector
An authenticated attacker sends an HTTP request to a vulnerable plugin endpoint with a parameter value containing SQL metacharacters. The injected payload modifies the resulting query to extract data through UNION SELECT clauses, time-based blind techniques, or boolean-based inference. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.
Detection Methods for CVE-2025-60110
Indicators of Compromise
- HTTP requests to AllInOne Banner Rotator endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA
- Database error messages in web server logs referencing the plugin's query strings
- Unusual outbound database query latency or repeated requests with incrementing payload values consistent with blind injection
- Unexpected reads against the wp_users or wp_options tables originating from the plugin's request handlers
Detection Strategies
- Inspect WordPress access logs for query parameters containing encoded SQL syntax targeting plugin URLs under /wp-content/plugins/all-in-one-bannerRotator/
- Deploy a Web Application Firewall (WAF) ruleset that flags SQL injection signatures on plugin endpoints
- Enable MySQL general query logging temporarily to identify anomalous SELECT statements correlated with plugin activity
Monitoring Recommendations
- Alert on authenticated WordPress users issuing high volumes of requests to the affected plugin
- Forward web server, database, and WordPress audit logs to a centralized analytics platform for correlation
- Monitor for new administrator accounts or modified user metadata following suspicious plugin activity
How to Mitigate CVE-2025-60110
Immediate Actions Required
- Disable the AllInOne Banner Rotator plugin until a patched release is verified and installed
- Audit WordPress user accounts and rotate credentials for any account that interacted with the plugin
- Review database logs for evidence of unauthorized SELECT activity against sensitive tables
- Restrict access to WordPress authoring roles using strong authentication and least privilege
Patch Information
At publication time, the advisory lists versions through 3.8 as affected. Monitor the Patchstack SQL Injection Vulnerability advisory and the vendor distribution channel for an updated release that introduces parameterized queries.
Workarounds
- Remove the plugin if business requirements do not justify its continued use
- Place WAF rules in front of WordPress to block SQL injection patterns targeting plugin parameters
- Restrict the WordPress database account used by the plugin to the minimum tables and privileges required
# Disable the plugin via WP-CLI while a fix is pending
wp plugin deactivate all-in-one-bannerRotator
wp plugin status all-in-one-bannerRotator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
