CVE-2025-8994: WP Project Manager SQL Injection Vulnerability

CVE-2025-8994 Overview

CVE-2025-8994 is a time-based SQL injection vulnerability in the WP Project Manager plugin for WordPress. The flaw affects all versions up to and including 2.6.26. It stems from insufficient escaping of the completed_at_operator parameter and inadequate preparation of the underlying SQL query in src/Task/Helper/Task.php.

Authenticated users with Subscriber-level access or higher can append arbitrary SQL to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials and session tokens.

Critical Impact
Authenticated attackers with low-privilege Subscriber accounts can extract sensitive database contents from affected WordPress installations.

Affected Products

WP Project Manager plugin for WordPress — all versions through 2.6.26
WordPress sites with Subscriber-level or higher registration enabled
Any site exposing the plugin's task filtering endpoints

Discovery Timeline

2025-11-15 - CVE-2025-8994 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-8994

Vulnerability Analysis

The vulnerability is a time-based blind SQL injection classified under [CWE-89]. It resides in the task filtering logic of WP Project Manager, specifically where the completed_at_operator parameter is concatenated into a SQL statement without proper sanitization or parameter binding.

Time-based injection relies on conditional delays, typically via SLEEP() or BENCHMARK(). Attackers infer query results from server response timing even when the application returns no visible output. This allows byte-by-byte extraction of database contents including WordPress user hashes stored in wp_users.

The attack requires authentication at the Subscriber level, which is the lowest WordPress role. Many WordPress sites allow open Subscriber registration, lowering the practical barrier to exploitation.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The affected code path in src/Task/Helper/Task.php around line 1484 accepts the completed_at_operator value from the request and injects it into a raw SQL query. The plugin does not use $wpdb->prepare() with proper placeholders for this parameter, nor does it validate the operator against an allow-list of permitted comparison operators.

Attack Vector

Exploitation occurs over the network through authenticated HTTP requests to the plugin's task endpoints. An attacker with a valid Subscriber session supplies a crafted completed_at_operator value containing SQL conditional logic that triggers a measurable delay when a boolean condition is true.

See the WordPress Plugin Code Review for the vulnerable function and the Wordfence Vulnerability Analysis for additional context.

Detection Methods for CVE-2025-8994

Indicators of Compromise

HTTP requests to WP Project Manager task endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the completed_at_operator parameter.
Unusually long response times from WordPress AJAX or REST endpoints associated with the plugin.
Repeated authenticated requests from a single Subscriber account iterating over the completed_at_operator value.
Database query logs showing malformed WHERE completed_at clauses.

Detection Strategies

Enable WordPress query logging and alert on queries containing SLEEP( or BENCHMARK( originating from the plugin's task helper.
Inspect web server access logs for POST or GET requests with suspicious operator values that are not standard comparison symbols.
Monitor Subscriber-level accounts for anomalous activity volumes against plugin endpoints.

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule to block non-whitelisted characters in the completed_at_operator parameter.
Correlate authentication events with task endpoint activity in your SIEM to flag freshly registered accounts probing the plugin.
Baseline normal response latency for plugin endpoints and alert on statistical outliers consistent with time-based injection probes.

How to Mitigate CVE-2025-8994

Immediate Actions Required

Update WP Project Manager to a version later than 2.6.26 that addresses the issue referenced in WordPress Changeset #3386164.
Audit WordPress user accounts and remove unused Subscriber accounts, especially those created without legitimate business need.
Rotate credentials and session tokens if logs show evidence of exploitation attempts.

Patch Information

The maintainers resolved the vulnerability in a release following 2.6.26. Review the fix in WordPress Changeset #3386164 and apply the latest plugin update through the WordPress admin dashboard or by replacing the plugin files directly.

Workarounds

Disable open user registration or restrict new accounts from the default Subscriber role until patched.
Deactivate the WP Project Manager plugin on affected sites if patching is not immediately feasible.
Apply WAF rules that enforce an allow-list of valid SQL comparison operators (=, !=, <, <=, >, >=) on the completed_at_operator parameter.
Restrict access to plugin endpoints by IP where administrative use allows it.

bash

# Example WAF rule concept (ModSecurity-style) to block injection payloads
SecRule ARGS:completed_at_operator "!@rx ^(=|!=|<|<=|>|>=)$" \
    "id:1008994,phase:2,deny,status:403,msg:'Blocked CVE-2025-8994 injection attempt'"