CVE-2025-9441: iATS Online Forms WordPress SQL Injection

CVE-2025-9441 Overview

CVE-2025-9441 affects the iATS Online Forms plugin for WordPress in all versions up to and including 1.2. The plugin fails to properly escape the order parameter and does not adequately prepare the underlying SQL query. Authenticated users with Contributor-level access or higher can inject time-based SQL payloads to extract data from the WordPress database. The flaw is classified as SQL Injection [CWE-89].

Critical Impact
Authenticated attackers with Contributor privileges can extract sensitive information, including user credentials and application secrets, from the WordPress database through time-based blind SQL injection.

Affected Products

iATS Online Forms plugin for WordPress, versions 1.0 through 1.2
WordPress installations with the plugin active and Contributor-or-higher accounts provisioned
Any downstream site relying on the vulnerable class-iats-form-table.php component

Discovery Timeline

2025-08-29 - CVE-2025-9441 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9441

Vulnerability Analysis

The vulnerability resides in the plugin's administrative form table listing logic, specifically in class-iats-form-table.php. The order request parameter is concatenated into a SQL query used to sort form submission records. Because the plugin does not sanitize the parameter and does not use prepared statements with parameter binding, attacker-controlled SQL fragments are executed by the database engine.

Exploitation is blind but reliable through time-based techniques. An attacker submits payloads that invoke SLEEP() or conditional delay functions and infers data by measuring server response latency. Contributor accounts are commonly permitted through open registration or lightly moderated content workflows, which lowers the practical barrier to abuse.

Successful exploitation exposes any data readable by the WordPress database user, including wp_users password hashes, session tokens stored by security plugins, and secrets kept in wp_options.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The vulnerable code path accepts the order parameter from HTTP requests and injects it directly into the ORDER BY clause of a query without invoking wpdb::prepare() or an allowlist validator. WordPress's $wpdb API cannot parameterize identifiers or clause fragments, which requires developers to explicitly validate order/orderby values against a fixed set.

Attack Vector

The attack requires network access to the WordPress admin surface and a valid Contributor-or-higher session. The attacker issues a crafted request to the plugin's form table endpoint with a malicious order value. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for technical details on the injection point.

// No verified exploit code is published. The injection point is the
// `order` parameter in the plugin's admin form table listing request.
// Time-based payloads leveraging SLEEP() produce measurable response delays.

Detection Methods for CVE-2025-9441

Indicators of Compromise

HTTP requests to iATS Online Forms admin endpoints containing SLEEP(, BENCHMARK(, IF(, or encoded variants within the order parameter
Anomalous database query latency correlated with authenticated Contributor sessions
Newly created Contributor-level accounts followed by repeated requests to plugin admin pages
Unexpected reads against wp_users, wp_usermeta, or wp_options tables from the web application user

Detection Strategies

Enable WordPress debug logging and database slow-query logging to capture malformed ORDER BY clauses
Deploy a Web Application Firewall rule set that inspects the order parameter for SQL keywords and delay functions
Correlate authenticated user sessions with SQL error patterns and long-running queries in application logs

Monitoring Recommendations

Alert on repeated administrative requests from Contributor accounts, especially against plugin listing pages
Baseline normal query duration for the plugin's admin endpoints and alert on statistical outliers
Review WordPress role assignments and audit accounts elevated to Contributor or higher in the last 90 days

How to Mitigate CVE-2025-9441

Immediate Actions Required

Deactivate and remove the iATS Online Forms plugin if a patched release is not installed
Restrict Contributor and higher role assignments until the plugin is updated or removed
Rotate WordPress administrator passwords and any secrets accessible from the database
Review the WordPress Plugin Developer Page for the latest release information

Patch Information

All versions up to and including 1.2 are vulnerable. Site operators should monitor the plugin's developer page for a fixed release addressing the order parameter handling in class-iats-form-table.php. Until a patched version is confirmed, treat the plugin as unpatched and apply compensating controls.

Workarounds

Remove the plugin from production sites and export any required form data through an alternative mechanism
Enforce Web Application Firewall rules that reject requests containing SQL syntax in the order parameter
Limit WordPress registration to trusted users and disable open Contributor sign-ups
Restrict database privileges for the WordPress user to the minimum required tables and operations

bash

# Example WAF rule concept for ModSecurity to block SQLi payloads in the order parameter
SecRule ARGS:order "@rx (?i)(sleep|benchmark|union|select|--|/\*)" \
    "id:1009441,phase:2,deny,status:403,msg:'CVE-2025-9441 iATS Online Forms SQLi attempt'"