CVE-2025-30788
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in the Eli EZ SQL Reports Shortcode Widget and DB Backup WordPress plugin allows attackers to trick authenticated administrators into performing unintended SQL injection actions. This affects WordPress sites using the plugin versions up to 5.25.08, potentially leading to data theft or manipulation. The vulnerability combines CSRF with SQL injection, requiring user interaction but no authentication for exploitation.
💻 Affected Systems
- Eli EZ SQL Reports Shortcode Widget and DB Backup
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary SQL commands via CSRF, leading to full database compromise, data exfiltration, or site takeover.
Likely Case
Unauthorized SQL queries that modify or delete data, disrupt site functionality, or extract sensitive information like user credentials.
If Mitigated
With proper CSRF tokens and input validation, the risk is minimized to no impact, as requests would be blocked or sanitized.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into clicking a malicious link, combining CSRF with SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 5.25.08
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Eli EZ SQL Reports Shortcode Widget and DB Backup' and update to the latest version. 4. Verify the update completes successfully.
🔧 Temporary Workarounds
Disable Plugin
WordPressTemporarily deactivate the plugin to prevent exploitation until patching is possible.
wp plugin deactivate elisqlreports
Implement CSRF Protection
allAdd custom CSRF tokens to plugin forms if source code access is available, though this is complex and not recommended over patching.
🧯 If You Can't Patch
- Restrict plugin access to trusted users only and monitor for suspicious activity.
- Use web application firewalls (WAF) to block SQL injection and CSRF attempts.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in WordPress admin under Plugins > Installed Plugins; if version is 5.25.08 or earlier, it is vulnerable.Check Version:
wp plugin get elisqlreports --field=versionVerify Fix Applied:
After updating, confirm the plugin version is above 5.25.08 in the same location and test functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs, especially from admin sessions triggered by external requests.
Network Indicators:
- HTTP POST requests to plugin endpoints without CSRF tokens, originating from untrusted sources.
SIEM Query:
Example: source="wordpress_logs" AND (event="sql_error" OR event="admin_action") AND plugin="elisqlreports"