SQL Injection Vulnerability in Ultimate Auction Pro Plugin for WordPress

CVE-2025-4204

What is CVE-2025-4204?

The Ultimate Auction Pro plugin for WordPress is susceptible to SQL Injection through the 'auction_id' parameter due to inadequate escaping of user-supplied data and insufficient preparation of existing SQL queries. This vulnerability allows unauthorized attackers to inject additional SQL queries, which can lead to the extraction of sensitive information stored in the database. It affects all versions up to and including 1.5.2, emphasizing the importance of immediate updates and security measures.

References