CVE-2025-10047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10047", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-05T18:41:12.227Z", "datePublished": "2025-10-22T08:27:11.796Z", "dateUpdated": "2026-04-08T17:31:23.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:23.788Z"}, "affected": [{"vendor": "pmbaldha", "product": "Email Tracker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3.15", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Email Tracker \u2013 Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Email Tracker <= 5.3.15 - Authenticated (Admin+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4be524-a763-4f2b-8a1d-6189014b4d86?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416646%40email-tracker&new=3416646%40email-tracker&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "\u0110\u1ee9c T\u00e0i"}], "timeline": [{"time": "2025-10-21T20:17:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T14:04:19.371613Z", "id": "CVE-2025-10047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T20:35:31.715Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T14:04:19.371613Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T14:05:37.858Z"}}], "cna": {"title": "Email Tracker <= 5.3.15 - Authenticated (Admin+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "\u0110\u1ee9c T\u00e0i"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "pmbaldha", "product": "Email Tracker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.3.15"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-21T20:17:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4be524-a763-4f2b-8a1d-6189014b4d86?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416646%40email-tracker&new=3416646%40email-tracker&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Email Tracker \u2013 Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:23.788Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10047", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:23.788Z", "dateReserved": "2025-09-05T18:41:12.227Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-22T08:27:11.796Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Email Tracker", "vendor": "pmbaldha", "versions": [{"lessThanOrEqual": "5.3.15", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Email Tracker \u2013 Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Email Tracker - Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'orderby' en todas las versiones hasta e incluyendo la 5.3.12 debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10047", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T14:04:19.371613Z", "version": "2.0.3"}}]}, "published": "2025-10-22T09:15:31.473", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416646%40email-tracker&new=3416646%40email-tracker&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4be524-a763-4f2b-8a1d-6189014b4d86?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:08:19.919467+00:00", "value": {"mitigation_remediation": ["Update the Email Tracker plugin to the latest available version where the SQL injection issue is resolved.", "Restrict or eliminate Administrator-level accounts that have access to the plugin, ensuring that only trusted users possess such privileges.", "Implement strict input validation for the 'orderby' parameter within the plugin\u2019s configuration or disable the feature if it is not required, thereby preventing malicious query formation."], "summary": {"action": "Patch upgrade", "impact": "Sensitive database information exposure"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Email Tracker plugin version 5.3.15 or earlier are affected. The vulnerable vendor is pmbaldha and the product is Email Tracker. All releases up to and including 5.3.15 contain the flaw.", "description_and_impact": "The plugin Email Tracker suffers from an SQL Injection flaw triggered by the 'orderby' parameter. Insufficient escaping and lack of prepared statements allow an attacker with Administrator-level access to inject and execute arbitrary SQL commands. The resulting impact is the unauthorized extraction of sensitive data from the WordPress database, constituting a data exposure vulnerability.", "risk_and_exploitability": "The CVSS score of 4.9 indicates a moderate severity. The EPSS score is below 1%, reflecting a very low probability of exploitation in the wild. The vulnerability requires authenticated access at the Administrator level, so the attack surface is limited to sites where such credentials exist. The flaw does not appear in the CISA KEV catalog, and no widespread exploitation has been reported."}}}}, "created": "2025-10-23T10:07:49.229134+00:00", "updated": "2026-04-21T02:15:06.528191+00:00", "vendors": ["pmbaldha", "pmbaldha$PRODUCT$email_tracker", "wordpress", "wordpress$PRODUCT$wordpress"]}