CVE-2025-10045

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10045", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-05T18:28:17.507Z", "datePublished": "2025-10-15T08:25:52.005Z", "dateUpdated": "2026-04-08T16:42:27.079Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:27.079Z"}, "affected": [{"vendor": "onofficeweb", "product": "onOffice for WP-Websites", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "onOffice for WP-Websites <= 6.5.1 - Authenticated (Editor+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3447130/onoffice-for-wp-websites/trunk/plugin/Record/RecordManagerReadListViewEstate.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "\u0110\u1ee9c T\u00e0i"}], "timeline": [{"time": "2025-10-14T19:47:22.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T14:11:14.757664Z", "id": "CVE-2025-10045", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:11:19.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10045", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T14:11:14.757664Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T19:38:40.519Z"}}], "cna": {"title": "onOffice for WP-Websites <= 5.7 - Authenticated (Editor+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "\u0110\u1ee9c T\u00e0i"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "onofficeweb", "product": "onOffice for WP-Websites", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T19:47:22.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve"}, {"url": "https://plugins.svn.wordpress.org/onoffice-for-wp-websites/tags/5.7/plugin/Record/RecordManagerReadListViewEstate.php#97"}], "descriptions": [{"lang": "en", "value": "The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-15T08:25:52.005Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10045", "state": "PUBLISHED", "dateUpdated": "2025-11-25T14:11:19.121Z", "dateReserved": "2025-09-05T18:28:17.507Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:25:52.005Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "onOffice for WP-Websites", "vendor": "onofficeweb", "versions": [{"lessThanOrEqual": "6.5.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin onOffice para WP-Websites para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'order' en todas las versiones hasta la 5.7, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel Editor o superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10045", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10045", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T14:11:14.757664Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:36.600", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3447130/onoffice-for-wp-websites/trunk/plugin/Record/RecordManagerReadListViewEstate.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:41:39.596033+00:00", "value": {"mitigation_remediation": ["Update the onOffice for WP-Websites plugin to the latest available version, ensuring any future fixes address the SQL Injection flaw.", "If an update cannot be applied immediately, reduce the number of users with Editor or higher roles or reassign those roles to users who do not need access to the plugin's features.", "Disabling or removing the onOffice for WP-Websites plugin from the WordPress installation will eliminate the vulnerability while a fix is available."], "summary": {"action": "Update Plugin", "impact": "SQL Injection allowing authenticated Editor or higher users to extract confidential database information"}, "threat_synthesis": {"affected_systems": "All installations of the onOffice for WP-Websites plugin whose version is 6.5.1 or older are affected. The provided data does not indicate that any newer release fixes the issue, so all such installations must be treated as vulnerable until the vendor supplies a corrected version.", "description_and_impact": "The onOffice for WP-Websites plugin is vulnerable to a SQL Injection flaw that originates from the \"order\" parameter. Unsanitized input combined with a lack of prepared statements enables an authenticated user with Editor privileges or greater to append arbitrary SQL commands to existing queries, allowing extraction of sensitive data stored in the WordPress database and compromising confidentiality.", "risk_and_exploitability": "The CVSS score of 4.9 places the vulnerability in a medium severity range, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Compromise requires authenticated access with at least Editor privileges, limiting the attack surface. The flaw is not listed in the CISA KEV catalog. Nevertheless, an attacker who gains or controls an Editor account could read protected database content and potentially facilitate further attacks."}}}}, "created": "2025-10-20T13:26:50.486129+00:00", "updated": "2026-04-27T23:45:15.894064+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}