SQL Injection Vulnerability in My Auctions Allegro Plugin for WordPress

CVE-2025-10048

What is CVE-2025-10048?

The My Auctions Allegro plugin for WordPress is susceptible to SQL Injection attacks via the 'order' parameter. The vulnerability arises from inadequate user input escaping and insufficient preparation of SQL queries in versions up to and including 3.6.31. Authenticated users with Administrator-level access can exploit this vulnerability to inject additional SQL queries, potentially leading to unauthorized access to sensitive database information. It is crucial for users to update to the latest version to mitigate this risk.

References