CVE-2025-10002

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10002", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-04T18:21:57.134Z", "datePublished": "2025-09-20T04:27:56.228Z", "dateUpdated": "2026-04-08T17:26:28.527Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:28.527Z"}, "affected": [{"vendor": "clickwhale", "product": "ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted."}], "title": "ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3361848/clickwhale/trunk/includes/admin/Clickwhale_Ajax.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Naoya Takahashi"}], "timeline": [{"time": "2025-09-05T08:26:43.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-19T15:50:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-22T15:06:41.331596Z", "id": "CVE-2025-10002", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T15:06:52.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10002", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-22T15:06:41.331596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T15:06:43.763Z"}}], "cna": {"title": "ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection", "credits": [{"lang": "en", "type": "finder", "value": "Naoya Takahashi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "clickwhale", "product": "ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-05T08:26:43.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-19T15:50:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3361848/clickwhale/trunk/includes/admin/Clickwhale_Ajax.php"}], "descriptions": [{"lang": "en", "value": "The ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:28.527Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10002", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:28.527Z", "dateReserved": "2025-09-04T18:21:57.134Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-20T04:27:56.228Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages", "vendor": "clickwhale", "versions": [{"lessThanOrEqual": "2.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted."}], "id": "CVE-2025-10002", "lastModified": "2026-06-17T08:27:30.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10002", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-22T15:06:41.331596Z", "version": "2.0.3"}}]}, "published": "2025-09-20T05:15:34.607", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3361848/clickwhale/trunk/includes/admin/Clickwhale_Ajax.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:50:18.545784+00:00", "value": {"mitigation_remediation": ["Upgrade ClickWhale to any release newer than 2.5.0, where the SQL injection is fixed.", "Restrict the plugin\u2019s functionality to Administrator role users and review role assignments to ensure no lower\u2011privileged accounts can execute export_csv().", "Refactor the export_csv() routine to use prepared statements or parameterized queries and sanitize all user\u2011supplied input to eliminate any remaining SQL injection risk."], "summary": {"action": "Immediate Patch", "impact": "SQL Injection exposing sensitive database content"}, "threat_synthesis": {"affected_systems": "The affected product is ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages, a WordPress plugin. Versions up to and including 2.5.0 contain the flaw; versions released after 2.5.0 are not listed as affected.", "description_and_impact": "The ClickWhale WordPress plugin is vulnerable to SQL injection through the export_csv() function because user input is not properly escaped and the query is not prepared. This flaw, classified as CWE\u201189, would allow an attacker to append additional SQL statements to the existing query, resulting in extraction of sensitive database information. The vulnerability is exploitable only by authenticated users who have at least Administrator privileges, though it could be leveraged by lower\u2011level users if the plugin is granted to them.", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity, but the EPSS score of <1% reflects a very low likelihood that this weakness will be exploited in the wild. The vulnerability is not currently in CISA\u2019s KEV catalog, suggesting that no widespread exploitation is known. Nevertheless, the flaw permits attackers with sufficient authentication to read privileged data, so risk rises if an admin account is compromised or if non\u2011administrator users are granted plugin access. The attack vector is authenticated access, requiring active logins to the WordPress backend and the use of the export function, which makes public\u2011remote exploitation impossible."}}}}, "created": "2025-09-22T09:58:54.308992+00:00", "updated": "2026-04-21T03:00:06.375551+00:00", "vendors": ["flowdee", "flowdee$PRODUCT$clickwhale", "wordpress", "wordpress$PRODUCT$wordpress"]}