CVE-2025-9073

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9073", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-15T15:03:21.632Z", "datePublished": "2025-09-11T07:24:53.628Z", "dateUpdated": "2026-04-08T16:53:05.441Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:05.441Z"}, "affected": [{"vendor": "maheshmthorat", "product": "All in one Minifier", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "All in one Minifier <= 3.2 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "David Spruengli"}], "timeline": [{"time": "2025-09-10T18:49:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:05:33.638403Z", "id": "CVE-2025-9073", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:40:08.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:05:33.638403Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:05:35.439Z"}}], "cna": {"title": "All in one Minifier <= 3.2 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "David Spruengli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "maheshmthorat", "product": "All in one Minifier", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:49:52.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php"}], "descriptions": [{"lang": "en", "value": "The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-11T07:24:53.628Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9073", "state": "PUBLISHED", "dateUpdated": "2025-09-11T14:40:08.338Z", "dateReserved": "2025-08-15T15:03:21.632Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:53.628Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All in one Minifier", "vendor": "maheshmthorat", "versions": [{"lessThanOrEqual": "3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2025-9073", "lastModified": "2026-06-17T10:08:15.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9073", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:05:33.638403Z", "version": "2.0.3"}}]}, "published": "2025-09-11T08:15:36.177", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:06:47.828027+00:00", "value": {"mitigation_remediation": ["Upgrade All in one Minifier to the latest stable release (\u22653.3), which removes the vulnerable handling of the 'post_id' parameter.", "If an upgrade cannot be performed immediately, disable the plugin to eliminate the exploitable code.", "Restrict access to the wp-admin/admin-ajax.php endpoint so that only authenticated users can reach it, for example by configuring .htaccess rules or using a security plugin that limits AJAX endpoints."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated SQL injection"}, "threat_synthesis": {"affected_systems": "WordPress sites using the All in one Minifier plugin, version 3.2 or earlier, provided by vendor maheshmthorat. Any installation of that plugin up to and including version 3.2 is impacted.", "description_and_impact": "The All in one Minifier WordPress plugin contains a flaw that allows a remote attacker to inject arbitrary SQL through the 'post_id' input on the admin-ajax.php endpoint. The plugin fails to escape this parameter and does not use prepared statements, so an attacker can append additional SQL statements and read sensitive database content. This vulnerability maps to CWE\u201189 and can be exploited without authentication.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity risk; the EPSS score of less than 1% shows a low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. Attackers would need only to send a crafted HTTP request to wp-admin/admin-ajax.php containing a malicious 'post_id' value, which does not require authentication, suggesting a remote attack path via the web interface."}}}}, "created": "2025-09-12T09:11:23.061779+00:00", "updated": "2026-04-21T19:15:26.035787+00:00", "vendors": ["maheshmthorat", "maheshmthorat$PRODUCT$all_in_one_minifier_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}