CVE-2025-10045
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Description
The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Analysis
SQL Injection in onOffice for WP-Websites plugin (versions ≤6.5.1) allows authenticated attackers with Editor-level access or above to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'order' parameter. The vulnerability requires high privileges and user interaction is not needed, resulting in a CVSS score of 4.9 with confirmed confidentiality impact but no integrity or availability compromise.
Technical Context
The onOffice for WP-Websites WordPress plugin fails to properly escape and prepare the 'order' parameter before incorporating it into SQL queries, specifically in the RecordManagerReadListViewEstate.php component. This is a classic CWE-89 SQL Injection vulnerability where user-supplied input is concatenated directly into SQL statements without parameterization or sufficient input validation. The vulnerability exists across all versions up to and including 6.5.1, affecting the WordPress plugin ecosystem which relies on database queries for property listing functionality. The vulnerability is triggered through parameters passed to listing view functionality, exploitable only by authenticated users with Editor-level permissions or above, limiting the attack surface to trusted WordPress user roles.
Affected Products
The onOffice for WP-Websites WordPress plugin is affected in all versions up to and including 6.5.1. This plugin is deployed across WordPress installations using the official WordPress plugin repository. The vulnerability is identified in the RecordManagerReadListViewEstate.php component. Wordfence threat intelligence has assigned identifier 259010bd-ccb4-4907-bea8-f49e6464eaa1 to track this issue.
Remediation
The primary remediation is to upgrade the onOffice for WP-Websites plugin to a version released after 6.5.1, which should include proper parameterized SQL query preparation and input escaping for the 'order' parameter. Users should apply this update immediately through the WordPress plugin management interface. Until a patched version is available, organizations can reduce risk by auditing and restricting Editor-level and higher access to trusted administrators only, as the vulnerability requires these privileges. The WordPress plugin repository changeset referenced in the NVD data (https://plugins.trac.wordpress.org/changeset/3447130/onoffice-for-wp-websites/trunk/plugin/Record/RecordManagerReadListViewEstate.php) may provide visibility into the specific code requiring remediation. For additional vulnerability details and monitoring, refer to the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today