CVE-2025-8977: WordPress Simple Download Monitor SQL Injection

CVE-2025-8977 Overview

CVE-2025-8977 is a time-based SQL Injection vulnerability in the Simple Download Monitor plugin for WordPress. The flaw affects all versions up to and including 3.9.33. It stems from insufficient escaping of the order parameter and inadequate preparation of the underlying SQL query. Authenticated users with Contributor-level access or higher, when granted appropriate permissions by an administrator, can append arbitrary SQL clauses to legitimate queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers with Contributor-level access can exfiltrate sensitive database contents through time-based SQL injection in the order parameter.

Affected Products

Simple Download Monitor plugin for WordPress, all versions up to and including 3.9.33
WordPress sites where Contributor-level accounts exist with plugin access permissions
WordPress installations granting elevated capabilities to lower-privilege roles via the plugin

Discovery Timeline

2025-08-28 - CVE-2025-8977 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8977

Vulnerability Analysis

The Simple Download Monitor plugin constructs a SQL query that incorporates the user-supplied order parameter directly into an ORDER BY clause. The plugin fails to sanitize or validate this input against an allowlist of acceptable sort directions or column identifiers. Because WordPress $wpdb->prepare() does not safely bind identifiers or SQL keywords in the ORDER BY position, the developer's failure to enforce strict validation exposes the query to injection.

An attacker with Contributor-level privileges submits a crafted order value containing a time-delay payload such as a subquery invoking SLEEP() or BENCHMARK(). Observing the server response time reveals whether injected boolean conditions evaluated true, enabling blind extraction of arbitrary database contents one bit at a time.

Root Cause

The root cause is improper neutralization of special elements in a dynamically built SQL statement (CWE-89). The affected code path in main.php around lines 255–261 concatenates the order request parameter into the query without an allowlist check. Refer to the WordPress Plugin Source Code and the WordPress Plugin Changeset Log for the specific fix.

Attack Vector

Exploitation is remote and requires authentication as a Contributor or higher role with plugin permissions granted by an administrator. The attacker sends an HTTP request to the affected plugin endpoint with a malicious order parameter. The payload appends SQL fragments that trigger measurable time delays based on conditional expressions. No user interaction is required beyond the attacker's own session, and no elevated privileges beyond Contributor are needed.

The vulnerability manifests in an admin-side listing handler where the order parameter selects sort direction. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-8977

Indicators of Compromise

HTTP requests to Simple Download Monitor admin endpoints containing SQL keywords such as SLEEP, BENCHMARK, SELECT, or UNION in the order query parameter
Abnormally long response times from wp-admin pages associated with the plugin, indicating time-based injection probing
Repeated authenticated requests from a Contributor-level account iterating through characters or bit positions
Unexpected outbound queries or elevated CPU on the database server correlated with plugin-related requests

Detection Strategies

Enable MySQL general query logging or slow query logging and alert on queries with ORDER BY clauses containing SLEEP or BENCHMARK functions
Deploy a web application firewall rule inspecting the order parameter for non-alphanumeric characters or SQL syntax
Correlate WordPress audit logs against database query patterns to identify Contributor accounts issuing anomalous requests

Monitoring Recommendations

Monitor for creation or privilege changes of Contributor-level WordPress accounts, especially those granted plugin capabilities
Track response-time anomalies on wp-admin endpoints associated with the plugin
Review WordPress plugin inventory and version data across managed sites to identify installations running 3.9.33 or earlier

How to Mitigate CVE-2025-8977

Immediate Actions Required

Update the Simple Download Monitor plugin to the version released after 3.9.33 that contains the fix referenced in changeset 3346068
Audit WordPress roles and remove unnecessary plugin capabilities from Contributor and Author accounts
Rotate database credentials, WordPress secret keys, and any administrative passwords if exploitation is suspected
Review database query and access logs for evidence of prior exploitation before patching

Patch Information

The vendor addressed CVE-2025-8977 in the release following version 3.9.33. The corrective commit is documented in the WordPress Plugin Changeset Log. Site administrators should update through the WordPress plugin dashboard or via WP-CLI. Verify installed versions on all managed WordPress instances after applying the update.

Workarounds

Revoke Contributor and Author permissions for the Simple Download Monitor plugin until the update is applied
Deploy a WAF rule that rejects requests where the order parameter contains characters outside [A-Za-z_] or values other than asc and desc
Temporarily disable the plugin on sites where an immediate update is not feasible

bash

# Update Simple Download Monitor via WP-CLI
wp plugin update simple-download-monitor

# Verify installed version is greater than 3.9.33
wp plugin get simple-download-monitor --field=version

# Optional: revoke plugin capabilities from lower-privilege roles
wp cap remove contributor manage_downloads