CVE-2025-9073: All in one Minifier SQLi Vulnerability

CVE-2025-9073 Overview

The All in one Minifier plugin for WordPress contains a SQL Injection vulnerability in the post_id parameter affecting all versions up to and including 3.2. The vulnerability stems from insufficient escaping of user-supplied input and lack of proper preparation on existing SQL queries. This security flaw enables unauthenticated attackers to append malicious SQL queries to legitimate database operations, potentially extracting sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the WordPress database without any authentication requirements, potentially compromising user credentials, personal information, and other confidential data stored in the database.

Affected Products

• All in one Minifier plugin for WordPress versions up to and including 3.2
• WordPress installations running vulnerable plugin versions
• Sites using the plugin's AJAX functionality via admin-ajax.php

Discovery Timeline

• 2025-09-11 - CVE-2025-9073 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-9073

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the All in one Minifier WordPress plugin's administrative AJAX handler. The flaw allows remote attackers to manipulate database queries through the post_id parameter without requiring any authentication. The vulnerability is particularly dangerous because it can be exploited over the network with low complexity, requiring no user interaction or special privileges.

The impact is primarily focused on confidentiality, as attackers can leverage the injection point to extract sensitive data from the database. This includes potential access to user credentials, email addresses, configuration data, and any other information stored in the WordPress database tables.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the plugin's SQL query construction. The post_id parameter is directly incorporated into SQL queries without adequate escaping or use of prepared statements with parameterized queries. WordPress provides functions like $wpdb->prepare() specifically to prevent SQL Injection attacks, but the vulnerable code fails to properly utilize these security mechanisms.

Attack Vector

The attack vector is network-based, allowing remote exploitation. Attackers can send specially crafted HTTP requests to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) with malicious SQL payloads in the post_id parameter. Since no authentication is required, any internet-connected attacker can attempt exploitation against vulnerable WordPress installations.

The attacker crafts a malicious request containing SQL metacharacters and additional SQL statements within the post_id parameter. When the plugin processes this parameter without proper sanitization, the malicious SQL code is executed against the database, allowing the attacker to perform unauthorized data extraction through techniques such as UNION-based injection, time-based blind injection, or error-based injection depending on the application's response behavior. Technical details about the vulnerable code can be found in the WordPress Plugin Trac repository.

Detection Methods for CVE-2025-9073

Indicators of Compromise

• Unusual or malformed requests to wp-admin/admin-ajax.php containing SQL keywords in the post_id parameter
• Database logs showing unexpected queries with UNION SELECT, OR 1=1, or other SQL injection patterns
• Increased error logs related to SQL query failures or syntax errors
• Evidence of data exfiltration or unauthorized database access in audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in request parameters
• Monitor WordPress AJAX endpoints for requests containing SQL metacharacters such as single quotes, double dashes, or semicolons
• Deploy database activity monitoring to detect unusual query patterns or unauthorized data access
• Review server access logs for suspicious requests targeting the All in one Minifier plugin endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and database queries
• Configure alerts for SQL error messages or exceptions in application logs
• Implement real-time monitoring of database queries for injection patterns
• Set up file integrity monitoring for the plugin directory to detect unauthorized modifications

How to Mitigate CVE-2025-9073

Immediate Actions Required

• Update the All in one Minifier plugin to a patched version immediately if available
• If no patch is available, deactivate and remove the plugin until a fix is released
• Implement WAF rules to block SQL injection attempts targeting the post_id parameter
• Review database access logs for signs of previous exploitation attempts

Patch Information

Organizations should check for updates to the All in one Minifier plugin through the official WordPress plugin repository. The vulnerability affects versions up to and including 3.2, so any version higher than 3.2 that addresses this issue should be applied immediately. For detailed vulnerability information, refer to the Wordfence Threat Intelligence report.

Workarounds

• Disable the All in one Minifier plugin until a security patch is available
• Implement input validation at the web server or WAF level to sanitize the post_id parameter
• Restrict access to wp-admin/admin-ajax.php to authenticated users only if feasible
• Consider using alternative minification plugins that have been audited for security vulnerabilities

# Example .htaccess rule to block suspicious post_id values
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} post_id=.*([';]+|--|\bUNION\b|\bSELECT\b|\bOR\b) [NC]
    RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
</IfModule>