CVE-2025-0866
📋 TL;DR
The Legoeso PDF Manager WordPress plugin contains a time-based SQL injection vulnerability in the 'checkedVals' parameter. Authenticated attackers with Author-level access or higher can exploit this to extract sensitive information from the database. This affects all versions up to and including 1.2.2.
💻 Affected Systems
- Legoeso PDF Manager WordPress Plugin
📦 What is this software?
Pdf Manager by Legoeso
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive database information including user credentials, personal data, and WordPress configuration secrets, potentially leading to full site compromise.
Likely Case
Attackers with Author access extract user data, plugin settings, and potentially escalate privileges by accessing administrative credentials.
If Mitigated
With proper access controls and network segmentation, impact is limited to data exposure within the WordPress database.
🎯 Exploit Status
SQL injection via time-based blind technique. Requires authenticated access but exploitation is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.3 or later
Vendor Advisory: https://wordpress.org/plugins/legoeso-pdf-manager/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Legoeso PDF Manager'. 4. Click 'Update Now' if update available. 5. Alternatively, download version 1.2.3+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate legoeso-pdf-manager
Restrict User Access
allLimit Author-level and above accounts to trusted users only
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with SQL injection rules
- Apply principle of least privilege to WordPress user accounts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Legoeso PDF Manager → Version. If version is 1.2.2 or lower, you are vulnerable.Check Version:
wp plugin get legoeso-pdf-manager --field=versionVerify Fix Applied:
Verify plugin version is 1.2.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in WordPress/database logs
- Multiple requests with 'checkedVals' parameter having SQL-like patterns
- Requests from Author-level users to PDF Manager endpoints with timing anomalies
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with 'checkedVals' parameter containing SQL syntax
- Unusually timed responses from PDF Manager endpoints
SIEM Query:
source="wordpress_logs" AND ("checkedVals" AND ("SLEEP" OR "BENCHMARK" OR "WAITFOR" OR "pg_sleep"))🔗 References
- https://plugins.trac.wordpress.org/browser/legoeso-pdf-manager/trunk/inc/admin/class-pdf-doc-list-table.php#L543
- https://plugins.trac.wordpress.org/browser/legoeso-pdf-manager/trunk/inc/admin/class-pdf-doc-list-table.php#L567
- https://wordpress.org/plugins/legoeso-pdf-manager/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5e640767-7998-4404-a894-0b1794464c66?source=cve
