Find Me On CVE-2025-10635

Requires an authenticated WordPress account with subscriber-level privileges or higher on a site running the Find Me On plugin version 2.0.9.1 or earlier; the attacker then injects SQL via a specific plugin parameter that is not sanitized or escaped before use in a SQL statement. The key limiting factor is the authentication requirement (PR:L) - exploitation is practical primarily where user self-registration is enabled or where the attacker already holds any low-privilege account. No special non-default configuration of the plugin itself is indicated, and no user interaction by a victim is required.

This is a moderate-risk, authenticated SQL injection in the Find Me On WordPress plugin (≤2.0.9.1). The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L = subscriber-level authentication). The requirement for a valid subscriber account materially lowers real-world risk versus an unauthenticated flaw, though WordPress sites with open registration or membership features effectively grant any visitor that privilege. Exploitation signals are weak-to-absent: EPSS is 0.27% (17th percentile), there is NO CISA KEV listing, and no public exploit or POC is referenced - so no public exploit identified at time of analysis. One notable inconsistency: the input vector asserts Scope:Changed (S:C) and only Confidentiality impact (C:H/I:N/A:N), which is atypical for a classic SQL injection - SQLi usually stays within the database (S:U) and frequently also permits data modification (I). The S:C and I:N choices should be verified against the WPScan advisory. Overall this reads as a genuine but lower-priority vulnerability: real injection flaw with data-disclosure potential, but gated behind authentication and showing no evidence of active or widespread exploitation.

An attacker registers or obtains a subscriber-level account on a WordPress site running the vulnerable Find Me On plugin, then submits a request containing a malicious value in the unsanitized parameter. The crafted input is concatenated into a backend SQL query, letting the attacker read arbitrary database contents such as user records and password hashes. No public exploit code is identified, so an attacker would need to craft the injection manually against the vulnerable parameter.