CVE-2025-10738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10738", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T16:18:05.852Z", "datePublished": "2025-12-13T06:33:55.887Z", "dateUpdated": "2026-04-08T16:38:13.910Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:13.910Z"}, "affected": [{"vendor": "rupok98", "product": "URL Shortener Plugin For WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the \u2018analytic_id\u2019 parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4acf11-114a-4e97-89cd-1d387f14a730?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852"}, {"url": "https://wordpress.org/plugins/exact-links/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "timeline": [{"time": "2025-12-12T18:31:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:30:18.977623Z", "id": "CVE-2025-10738", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:32:59.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T15:30:18.977623Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:30:19.979Z"}}], "cna": {"title": "URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "rupok98", "product": "URL Shortener Plugin For WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T18:31:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4acf11-114a-4e97-89cd-1d387f14a730?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852"}, {"url": "https://wordpress.org/plugins/exact-links/"}], "descriptions": [{"lang": "en", "value": "The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the \u2018analytic_id\u2019 parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:13.910Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10738", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:38:13.910Z", "dateReserved": "2025-09-19T16:18:05.852Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T06:33:55.887Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "URL Shortener Plugin For WordPress", "vendor": "rupok98", "versions": [{"lessThanOrEqual": "3.0.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the \u2018analytic_id\u2019 parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin URL Shortener Plugin For WordPress para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'analytic_id' en todas las versiones hasta la 3.0.7, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10738", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10738", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:30:18.977623Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:44.987", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/exact-links/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4acf11-114a-4e97-89cd-1d387f14a730?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:32:03.611130+00:00", "value": {"mitigation_remediation": ["Update the plugin to a version later than 3.0.7 released by the vendor.", "If an update is not immediately available, disable or remove the URL ShortenerPlugin from the WordPress installation to eliminate the attack vector.", "Implement input validation or restrict the analytic_id parameter to known safe values and ensure subsequent SQL queries use parameterized statements or proper escaping."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated SQL injection exposing sensitive data"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress URL Shortener Plugin for WordPress developed by rupok98. Any installation of the plugin with a version number 3.0.7 or earlier is impacted. Users of WordPress sites that have not yet migrated to a newer version of the plugin are at risk.", "description_and_impact": "The URL Shortener Plugin for WordPress is vulnerable to SQL injection via the analytic_id parameter in all versions up to 3.0.7. The insufficient escaping and lack of prepared statements allow unauthenticated attackers to append arbitrary SQL to the existing query, enabling extraction of sensitive data from the database. This flaw is a classic CWE-89 injection vulnerability that compromises the confidentiality of stored information.", "risk_and_exploitability": "The CVSS score is 9.8, denoting a critical severity level, while the EPSS score is below 1%, indicating a low probability of exploitation yet still requiring prompt action. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely and without authentication by sending crafted HTTP requests containing an analytic_id value that injects malicious SQL. Once exploited, the attacker could read or manipulate database contents."}}}}, "created": "2025-12-14T21:14:41.943662+00:00", "updated": "2026-04-22T20:45:27.080576+00:00", "vendors": ["rupok98", "rupok98$PRODUCT$url_shortener_plugin_for_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}