CVE-2025-9199: WordPress Woo Superb Slideshow SQL Injection

CVE-2025-9199 Overview

CVE-2025-9199 is a SQL Injection vulnerability affecting the Woo Superb Slideshow Transition Gallery with Random Effect plugin for WordPress. The flaw exists in the woo-superb-slideshow shortcode handler and impacts all plugin versions up to and including 9.1. The root cause is insufficient escaping of user-supplied parameters combined with the absence of prepared statements in the underlying SQL query. Authenticated attackers with Contributor-level access or higher can append arbitrary SQL to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database, including user credentials and session information.

Critical Impact
Authenticated contributors can execute arbitrary SQL queries against the WordPress database and exfiltrate sensitive information through the vulnerable shortcode.

Affected Products

Woo Superb Slideshow Transition Gallery with Random Effect plugin for WordPress
All versions up to and including 9.1
WordPress sites that permit Contributor-level or higher registration

Discovery Timeline

2025-10-03 - CVE-2025-9199 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9199

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw [CWE-89] triggered through the woo-superb-slideshow shortcode. When a user with Contributor privileges or higher embeds the shortcode in content, the plugin passes attacker-controlled attributes directly into a SQL query. The plugin fails to call WordPress sanitization helpers such as esc_sql() or to use $wpdb->prepare() with proper placeholders. Attackers can therefore break out of the intended query context and append subqueries using UNION SELECT or stacked clauses. Query results surface through the rendered slideshow output, enabling data extraction without requiring blind-injection techniques.

Root Cause

The plugin source referenced at line 61 of woo-superb-slideshow-transition-gallery-with-random-effect.php concatenates shortcode attributes into a SQL statement without parameterization. Both the escaping layer and the preparation layer are missing, so any string reaching the vulnerable parameter is interpolated verbatim into the query sent to $wpdb.

Attack Vector

Exploitation requires an authenticated WordPress session with Contributor-level privileges or above. The attacker publishes or previews a post containing the woo-superb-slideshow shortcode with a crafted attribute value. When WordPress renders the shortcode, the injected SQL executes against the backing database. No user interaction from an administrator is required. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-9199

Indicators of Compromise

Unexpected woo-superb-slideshow shortcode usage in posts authored by Contributor-level accounts.
Web server access logs showing POST requests to /wp-admin/post.php or /wp-admin/admin-ajax.php containing SQL keywords such as UNION, SELECT, or information_schema.
Database query logs showing anomalous SELECT statements originating from the plugin's shortcode handler.
Unexpected reads against the wp_users or wp_usermeta tables correlated with slideshow rendering.

Detection Strategies

Audit all installed WordPress plugins for the Woo Superb Slideshow Transition Gallery plugin at version 9.1 or earlier.
Enable MySQL general or slow query logging and alert on queries containing union-based injection patterns.
Deploy a Web Application Firewall (WAF) rule set that inspects shortcode attribute payloads for SQL metacharacters.

Monitoring Recommendations

Monitor creation of new Contributor, Author, or Editor accounts, especially from unfamiliar IP addresses.
Track draft and preview activity involving shortcodes and correlate with outbound data volume from the database host.
Review authentication telemetry for brute-force or credential-stuffing attempts targeting low-privilege WordPress roles.

How to Mitigate CVE-2025-9199

Immediate Actions Required

Deactivate and remove the Woo Superb Slideshow Transition Gallery with Random Effect plugin until a patched version is confirmed available.
Restrict user registration and disable self-service Contributor sign-ups on affected WordPress sites.
Rotate WordPress administrator passwords and database credentials if exploitation is suspected.
Review existing posts and drafts for unauthorized use of the woo-superb-slideshow shortcode.

Patch Information

At the time of publication, no fixed version is listed in the referenced advisories. Consult the Wordfence Vulnerability Report for the latest remediation status and apply any vendor update as soon as it becomes available.

Workarounds

Remove the plugin directory from wp-content/plugins/ on all affected sites.
Enforce least privilege by downgrading unnecessary Contributor-level accounts and auditing role assignments.
Deploy virtual patching through a WAF rule that blocks SQL metacharacters inside shortcode attributes.
Restrict database user privileges so the WordPress service account cannot read sensitive tables beyond those required.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate woo-superb-slideshow-transition-gallery-with-random-effect
wp plugin delete woo-superb-slideshow-transition-gallery-with-random-effect

# Disable open user registration until patched
wp option update users_can_register 0