What is the CVSS score of CVE-2025-10045?

CVE-2025-10045 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-10045

MEDIUM

SQL Injection (CWE-89)

2025-10-15 security@wordfence.com

WordPress SQLi

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

MEDIUM 4.9

DescriptionCVE.org

The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in onOffice for WP-Websites plugin (versions ≤6.5.1) allows authenticated attackers with Editor-level access or above to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'order' parameter. The vulnerability requires high privileges and user interaction is not needed, resulting in a CVSS score of 4.9 with confirmed confidentiality impact but no integrity or availability compromise.

Technical ContextAI

The onOffice for WP-Websites WordPress plugin fails to properly escape and prepare the 'order' parameter before incorporating it into SQL queries, specifically in the RecordManagerReadListViewEstate.php component. This is a classic CWE-89 SQL Injection vulnerability where user-supplied input is concatenated directly into SQL statements without parameterization or sufficient input validation. The vulnerability exists across all versions up to and including 6.5.1, affecting the WordPress plugin ecosystem which relies on database queries for property listing functionality. The vulnerability is triggered through parameters passed to listing view functionality, exploitable only by authenticated users with Editor-level permissions or above, limiting the attack surface to trusted WordPress user roles.

Affected ProductsAI

The onOffice for WP-Websites WordPress plugin is affected in all versions up to and including 6.5.1. This plugin is deployed across WordPress installations using the official WordPress plugin repository. The vulnerability is identified in the RecordManagerReadListViewEstate.php component. Wordfence threat intelligence has assigned identifier 259010bd-ccb4-4907-bea8-f49e6464eaa1 to track this issue.

RemediationAI

The primary remediation is to upgrade the onOffice for WP-Websites plugin to a version released after 6.5.1, which should include proper parameterized SQL query preparation and input escaping for the 'order' parameter. Users should apply this update immediately through the WordPress plugin management interface. Until a patched version is available, organizations can reduce risk by auditing and restricting Editor-level and higher access to trusted administrators only, as the vulnerability requires these privileges. The WordPress plugin repository changeset referenced in the NVD data (https://plugins.trac.wordpress.org/changeset/3447130/onoffice-for-wp-websites/trunk/plugin/Record/RecordManagerReadListViewEstate.php) may provide visibility into the specific code requiring remediation. For additional vulnerability details and monitoring, refer to the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve).