CVE-2025-10142

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10142", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-08T20:46:52.706Z", "datePublished": "2025-09-10T06:38:51.593Z", "dateUpdated": "2026-04-08T17:26:35.745Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:35.745Z"}, "affected": [{"vendor": "martins56", "product": "PagBank / PagSeguro Connect para WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.44.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 4.44.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d774bd22-4d4e-42d4-b4ae-c833dd36aa79?source=cve"}, {"url": "https://wordpress.org/plugins/pagbank-connect/"}, {"url": "https://github.com/r-martins/PagBank-WooCommerce/commit/a9c3352fae0bb17b4c359ebe212bf4652e756b43#diff-b2c1b76195d79c48df3a3a809e0fa3e7ce08dc4a4ad6e9bba3c599ae1c28c2d2"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3358325%40pagbank-connect&new=3358325%40pagbank-connect&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "timeline": [{"time": "2025-09-09T05:25:47.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-09T18:11:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T14:52:05.879326Z", "id": "CVE-2025-10142", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T14:59:27.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10142", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T14:52:05.879326Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T14:59:23.795Z"}}], "cna": {"title": "PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Moose Love"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "martins56", "product": "PagBank / PagSeguro Connect para WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.44.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-09T05:25:47.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-09T18:11:36.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d774bd22-4d4e-42d4-b4ae-c833dd36aa79?source=cve"}, {"url": "https://wordpress.org/plugins/pagbank-connect/"}, {"url": "https://github.com/r-martins/PagBank-WooCommerce/commit/a9c3352fae0bb17b4c359ebe212bf4652e756b43#diff-b2c1b76195d79c48df3a3a809e0fa3e7ce08dc4a4ad6e9bba3c599ae1c28c2d2"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3358325%40pagbank-connect&new=3358325%40pagbank-connect&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 4.44.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-10T06:38:51.593Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10142", "state": "PUBLISHED", "dateUpdated": "2025-09-10T14:59:27.883Z", "dateReserved": "2025-09-08T20:46:52.706Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-10T06:38:51.593Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PagBank / PagSeguro Connect para WooCommerce", "vendor": "martins56", "versions": [{"lessThanOrEqual": "4.44.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 4.44.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2025-10142", "lastModified": "2026-06-17T08:27:46.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10142", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T14:52:05.879326Z", "version": "2.0.3"}}]}, "published": "2025-09-10T07:15:44.500", "references": [{"source": "security@wordfence.com", "url": "https://github.com/r-martins/PagBank-WooCommerce/commit/a9c3352fae0bb17b4c359ebe212bf4652e756b43#diff-b2c1b76195d79c48df3a3a809e0fa3e7ce08dc4a4ad6e9bba3c599ae1c28c2d2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3358325%40pagbank-connect&new=3358325%40pagbank-connect&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/pagbank-connect/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d774bd22-4d4e-42d4-b4ae-c833dd36aa79?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:06:34.847851+00:00", "value": {"mitigation_remediation": ["Upgrade the PagBank / PagSeguro Connect para WooCommerce plugin to the latest available version (4.44.4 or newer) to eliminate the SQL injection flaw.", "If an immediate upgrade is not feasible, restrict or remove Shop Manager+ user accounts from sites that use the vulnerable plugin, or uninstall the plugin entirely.", "Deploy a Web Application Firewall rule that detects and blocks suspicious SQL payloads targeting the \u2018status\u2019 parameter to provide interim protection."], "summary": {"action": "Immediate Patch", "impact": "Authenticated SQL Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the martins56 PagBank / PagSeguro Connect para WooCommerce WordPress plugin in all releases up to and including version 4.44.3. Any WordPress site that has this plugin installed and whose users include accounts with Shop Manager or higher privileges is potentially impacted.", "description_and_impact": "The PagBank / PagSeguro Connect para WooCommerce plugin contains a SQL injection flaw caused by inadequate escaping of the 'status' parameter in the plugin\u2019s database queries. This weakness, classified as CWE-89, enables an attacker who is authenticated with Shop Manager level access or higher to append malicious SQL statements to the existing query, potentially allowing the extraction of sensitive database information.", "risk_and_exploitability": "The CVSS score of 4.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The attacker must first have valid credentials with Shop Manager or better privileges; once authenticated, they can exploit the flaw by sending a crafted request containing the 'status' parameter. The vulnerability is not listed in CISA\u2019s KEV catalog, but because it allows data exfiltration from the database, the risk to confidentiality remains significant for compromised sites."}}}}, "created": "2025-09-12T09:11:35.041168+00:00", "updated": "2026-04-21T03:15:16.330270+00:00", "vendors": ["woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}