CVE-2025-24659 – This SQL injection vulnerability in WordPress D... (How to Fix)

📋 TL;DR

This SQL injection vulnerability in WordPress Download Manager Premium Packages allows attackers to execute arbitrary SQL queries against the database. It affects all versions up to 5.9.6 of the premium plugin, potentially compromising WordPress sites using this plugin.

💻 Affected Systems

Products:

WordPress Download Manager Premium Packages

Versions: All versions up to and including 5.9.6

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects the premium version of the plugin, not the free version

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, site takeover, or data destruction

🟠

Likely Case

Data exfiltration of sensitive information like user credentials, payment details, or private downloads

🟢

If Mitigated

Limited impact with proper input validation and database permissions restricting damage

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Blind SQL injection requires more sophisticated exploitation techniques than standard SQLi

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 5.9.6

Vendor Advisory: https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-sell-digital-products-securely-plugin-5-9-6-sql-injection-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find 'Download Manager Premium Packages'
4. Click 'Update Now' if available
5. If no update shows, download latest version from vendor
6. Deactivate old plugin, upload new version, activate

🔧 Temporary Workarounds

Disable vulnerable plugin

WordPress

Temporarily disable the Premium Packages plugin until patched

wp plugin deactivate wpdm-premium-packages

Web Application Firewall rules

all

Implement WAF rules to block SQL injection patterns

🧯 If You Can't Patch

Implement strict input validation and parameterized queries in custom code
Restrict database user permissions to minimum required access

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin > Plugins > Installed Plugins for 'Download Manager Premium Packages' version 5.9.6 or earlier

Check Version:

wp plugin get wpdm-premium-packages --field=version

Verify Fix Applied:

Verify plugin version is higher than 5.9.6 in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual SQL error messages in WordPress logs
Multiple failed login attempts from single IP
Unexpected database queries

Network Indicators:

HTTP requests with SQL syntax in parameters
Unusual traffic patterns to plugin endpoints

SIEM Query:

source="wordpress.log" AND ("SQL syntax" OR "database error" OR "wpdm-premium-packages")

📊 Metadata

CVE ID: CVE-2025-24659

CVSS v3 Score: 7.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

CWE: CWE-89

EPSS Score: 3.94% exploit probability (88.1th percentile)

Published: January 24, 2025

Last Updated: January 24, 2025

🔗 References

https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-sell-digital-products-securely-plugin-5-9-6-sql-injection-vulnerability?_s_id=cve

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-24659, you might also want to check these: