CVE-2025-30628: 
WordPress vulnerability analysis and mitigation

CVE-2025-30628 is a SQL Injection vulnerability (CWE-89) in the AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer), a WordPress plugin. It affects all versions through 1.2 and was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on June 2, 2025, with public disclosure on December 31, 2025. The CVE was assigned by Patchstack, which rates it CVSS v3.1 8.5 (High) (Patchstack). As of the time of reporting, no official vendor patch is available.

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from insufficient sanitization of user-supplied input before it is incorporated into SQL queries within the plugin. Exploitation requires only low-level authenticated access (Subscriber-level WordPress user) and no user interaction, with a network attack vector and changed scope, indicating the impact can extend beyond the vulnerable component (Patchstack). The vulnerability is associated with CAPEC patterns including blind SQL injection (CAPEC-7), standard SQL injection (CAPEC-66), and command-line execution through SQL injection (CAPEC-108) (Feedly).

Successful exploitation allows an authenticated attacker with minimal privileges (Subscriber role) to execute arbitrary SQL commands against the WordPress database, primarily resulting in unauthorized access to sensitive data such as user credentials, personal information, and site configuration. The CVSS scoring reflects high confidentiality impact, no integrity impact, and low availability impact with a changed scope, meaning database contents beyond the plugin's own data may be exposed. In a worst-case scenario, extracted credentials could enable further account takeover or lateral movement within the hosting environment (Patchstack).

There is no public proof-of-concept exploit code and no confirmed in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.03%, indicating a low current probability of exploitation. However, Patchstack classifies this as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack). The vulnerability is not listed in the CISA KEV catalog, and no specific threat actor attribution has been made.

1. Reconnaissance: Identify WordPress sites running the Amazon Affiliates Addon for WPBakery Page Builder plugin (version ≤ 1.2) using tools like WPScan or Shodan with WordPress-specific fingerprinting.
2. Authentication: Obtain or register a low-privilege WordPress account (Subscriber level), which is often open for self-registration on many WordPress sites.
3. Identify vulnerable parameter: Interact with the plugin's functionality (e.g., shortcode rendering or AJAX endpoints exposed by the plugin) and identify input parameters that are passed unsanitized to SQL queries.
4. Craft SQL injection payload: Inject SQL syntax into the vulnerable parameter — for example, appending ' OR 1=1-- or using time-based blind injection payloads (e.g., ' AND SLEEP(5)--) to confirm exploitability.
5. Extract data: Use tools like sqlmap targeting the identified endpoint and parameter to automate extraction of WordPress database contents, including the wp_users table containing hashed passwords and email addresses.
6. Post-exploitation: Use extracted credentials for account takeover or further access to the WordPress admin panel (Patchstack).

• Network: Unusual HTTP requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) or plugin-specific URLs containing SQL metacharacters (', --, OR 1=1, SLEEP, UNION SELECT) in parameter values.
• Logs: WordPress or web server access logs showing repeated requests with encoded SQL payloads to plugin endpoints from a single low-privilege user account; time-delayed responses consistent with time-based blind SQL injection.
• Database: Unexpected or unauthorized queries in MySQL general query logs involving UNION SELECT, INFORMATION_SCHEMA, or wp_users table access originating from the WordPress application user.
• File System: Presence of new or modified PHP files in the plugin directory (/wp-content/plugins/azon-addon-js-composer/) that could indicate post-exploitation web shell placement.

No official patch from the vendor (AA-Team) is available for versions through 1.2 as of the disclosure date (Patchstack). Patchstack has issued a virtual patching/mitigation rule for subscribers of its service to block exploitation attempts until an official fix is released. Recommended immediate actions include: (1) disabling or removing the plugin if it is not critical to site operations; (2) restricting WordPress user registration to prevent unauthorized Subscriber-level accounts; (3) implementing a Web Application Firewall (WAF) with SQL injection rules; and (4) monitoring database and web server logs for anomalous SQL query patterns.

The vulnerability was covered by The Hacker Wire and discussed on social platforms including Bluesky and Mastodon shortly after disclosure (Feedly). It was also included in CISA's vulnerability bulletin for the week of December 29, 2025 (CISA Bulletin). Community reaction has been limited given the niche nature of the affected plugin, but Patchstack's classification as a high-priority, mass-exploit-campaign-type vulnerability has drawn attention to the risk for WordPress site operators.