WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability

Successful exploitation of this SQL Injection vulnerability could grant an attacker unauthorized access to the underlying database. This could lead to the exfiltration of sensitive customer data, including personal information, order details, and payment information. Depending on the database schema and permissions, an attacker might also be able to modify data, execute arbitrary commands on the server, or even gain complete control of the WordPress installation. The potential blast radius is significant, particularly if the database contains sensitive information or is connected to other critical systems. This vulnerability shares similarities with other SQL Injection attacks, where attackers leverage improper input validation to manipulate database queries.

WordPress websites utilizing the AA-Team Amazon Native Shopping Recommendations plugin, particularly those running versions prior to 1.3.1, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a successful attack on one site could potentially compromise others.

• wordpress / composer / npm:

grep -r "AA-Team Amazon Native Shopping Recommendations" /var/www/html/wp-content/plugins/
wp plugin list | grep "Amazon Native Shopping Recommendations"

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/amazon-native-shopping-recommendations/ | grep -i "SQL Injection"

1. 2026-01-05Disclosure

   disclosure

1. 予約済み2025-03-24
2. 公開日2026-01-05
3. 更新日2026-04-28
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-30633 is to immediately upgrade Amazon Native Shopping Recommendations to version 1.3.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These might include restricting access to the vulnerable endpoint through a Web Application Firewall (WAF) or proxy server, configuring strict input validation rules to sanitize user-supplied data, and carefully reviewing database permissions to limit the potential impact of a successful attack. Monitor WordPress logs for suspicious SQL queries or unusual database activity. After upgrading, confirm the fix by attempting a SQL Injection attack on the vulnerable endpoint and verifying that it is properly blocked.