SQL Injection Vulnerability in My Auctions Allegro Plugin for WordPress

CVE-2025-12850

What is CVE-2025-12850?

The My Auctions Allegro plugin for WordPress is susceptible to SQL Injection through the 'auction_id' parameter in all versions up to and including 3.6.32. This vulnerability arises from inadequate escaping of user-supplied parameters, allowing unauthenticated attackers to manipulate SQL queries. By appending malicious SQL code to existing queries, an attacker can gain unauthorized access to sensitive information stored in the database, posing significant security risks for users.

References