CVE-2025-10726

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10726", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T13:55:25.247Z", "datePublished": "2025-10-03T11:17:07.615Z", "dateUpdated": "2026-04-08T16:36:58.090Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:58.090Z"}, "affected": [{"vendor": "quantumrose", "product": "WPRecovery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files on the server by injecting file paths through the SQL query."}], "title": "WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=cve"}, {"url": "https://plugins.svn.wordpress.org/wprecovery/trunk/delete_backup.php"}, {"url": "https://plugins.svn.wordpress.org/wprecovery/trunk/index.php"}, {"url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/delete_backup.php#L5"}, {"url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/index.php#L166"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-10-02T22:35:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T17:54:10.823256Z", "id": "CVE-2025-10726", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T17:54:23.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10726", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T17:54:10.823256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T17:54:18.122Z"}}], "cna": {"title": "WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}}], "affected": [{"vendor": "quantumrose", "product": "WPRecovery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:35:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=cve"}, {"url": "https://plugins.svn.wordpress.org/wprecovery/trunk/delete_backup.php"}, {"url": "https://plugins.svn.wordpress.org/wprecovery/trunk/index.php"}, {"url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/delete_backup.php#L5"}, {"url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/index.php#L166"}], "descriptions": [{"lang": "en", "value": "The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files on the server by injecting file paths through the SQL query."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:58.090Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10726", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:58.090Z", "dateReserved": "2025-09-19T13:55:25.247Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:07.615Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPRecovery", "vendor": "quantumrose", "versions": [{"lessThanOrEqual": "2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files on the server by injecting file paths through the SQL query."}, {"lang": "es", "value": "El plugin WPRecovery para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'data[id]' en todas las versiones hasta la 2.0, inclusive. Esto se debe a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden usarse para extraer informaci\u00f3n sensible de la base de datos. Adem\u00e1s, el resultado de esta inyecci\u00f3n SQL se pasa directamente a la funci\u00f3n unlink() de PHP, permitiendo a los atacantes eliminar archivos arbitrarios en el servidor inyectando rutas de archivo a trav\u00e9s de la consulta SQL."}], "id": "CVE-2025-10726", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10726", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T17:54:10.823256Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:43.417", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/wprecovery/trunk/delete_backup.php"}, {"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/wprecovery/trunk/index.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/delete_backup.php#L5"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wprecovery/tags/2.0/index.php#L166"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T22:07:31.026926+00:00", "value": {"mitigation_remediation": ["Upgrade WPRecovery to a version newer than 2.0 where the injection flaw is fixed", "If an immediate update is not feasible, uninstall or disable the plugin entirely to eliminate the attack vector", "Configure a web application firewall or modify the site\u2019s scripts to block or restrict access to delete_backup.php and filter out malicious SQL patterns in the data[id] parameter"], "summary": {"action": "Patch Immediately", "impact": "Arbitrary File Deletion and Data Disclosure"}, "threat_synthesis": {"affected_systems": "All installations of the quantumrose WPRecovery plugin, version 2.0 and earlier, are affected. Those deploying older releases of the plugin for WordPress fall under the scope of this vulnerability.\n", "description_and_impact": "The WPRecovery WordPress plugin is vulnerable to an unauthenticated SQL injection through the data[id] parameter in all releases up to version 2.0. An attacker can append malicious SQL fragments to the query, allowing extraction of sensitive database content. The result of that injection is then passed directly to PHP\u2019s unlink() function, which permits the attacker to delete arbitrary files on the server. The combination of data exfiltration and file deletion represents a significant loss of confidentiality and integrity.\n", "risk_and_exploitability": "The CVSS base score of 9.1 highlights the severity, while the EPSS score of < 1% indicates that exploitation probability remains low but non\u2011zero. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending an unauthenticated HTTP request containing crafted data[id] input; no prior authentication or privileged access is necessary. The attack surface is thus wide, making the risk primarily driven by the high impact rather than widespread exploitation.\n"}}}}, "created": "2025-10-06T14:43:00.091362+00:00", "updated": "2026-04-22T22:15:26.351710+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}