My Auctions Allegro CVE-2025-10048

Requires an authenticated session with WordPress Administrator-level privileges (or higher) on a site where the My Auctions Allegro plugin version ≤3.6.31 is installed and active; the injectable path is the 'order' parameter of the plugin. No end-user interaction is needed (UI:N), but the Administrator-access prerequisite is the dominant limiting factor and sharply narrows the realistic attacker set to already-privileged users. Impact is limited to database read/exfiltration (confidentiality); the flaw does not grant integrity or availability impact.

This is a genuinely low-priority issue despite the CRITICAL-sounding CWE-89 (SQL Injection) label. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) scores 4.9 (Medium), and the single most important signal is PR:H - exploitation requires Administrator-level access to the WordPress site, which is confirmed by the NVD description ('authenticated attackers, with Administrator-level access and above'). An attacker who already holds WordPress admin can typically read the database or run arbitrary PHP through legitimate means, so the real-world marginal risk added by this bug is minimal. Supporting signals align with this: EPSS is low at 0.30% (20th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code is referenced. Impact is scoped to confidentiality only (C:H/I:N/A:N), consistent with the description's 'extract sensitive information from the database.' No signals conflict here - the high-privilege requirement, low EPSS, and absence of KEV/POC all point the same direction. The main caveat is that the CVSS was authored by the Wordfence CNA rather than NVD/vendor; the vector and privilege claim are mutually consistent and credible.

An attacker who has already obtained (or been granted) WordPress Administrator credentials on a site running the My Auctions Allegro plugin supplies a malicious value in the 'order' parameter, appending a crafted SQL clause to an existing query to read data such as user records or secrets from the WordPress database. Because PR:H is required, the realistic actor is a rogue/compromised admin or a multi-admin site scenario, not an anonymous internet attacker. No public proof-of-concept exploit is identified at time of analysis.