SQL Injection Vulnerability in onOffice for WP-Websites Plugin by WordPress
CVE-2025-10045

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Onoffice For WP-websites
Vendor
CVE Published:
15 October 2025

What is CVE-2025-10045?

The onOffice for WP-Websites plugin for WordPress is susceptible to a SQL Injection flaw through the 'order' parameter. This vulnerability arises from inadequate escaping of input and insufficient preparation of SQL queries. Authenticated attackers with Editor-level access or greater can exploit this issue by injecting unauthorized SQL commands into existing queries. This may allow the extraction of sensitive data from the database, posing serious risks to the affected WordPress instances.

Affected Version(s)

onOffice for WP-Websites * <= 5.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/onoffice-for-wp-website...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Đức Tài
JSON
.
CVE-2025-10045 : SQL Injection Vulnerability in onOffice for WP-Websites Plugin by WordPress