CVE-2025-10047: 
WordPress vulnerability analysis and mitigation

CVE-2025-10047 is a SQL Injection vulnerability in the "Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails" plugin for WordPress. It affects all versions up to and including 5.3.15, exploitable via the orderby parameter due to insufficient input escaping and improper SQL query preparation. The vulnerability was disclosed on October 22, 2025, and assigned a CVSS v3.1 base score of 4.9 (Medium) by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), stemming from insufficient escaping of the user-supplied orderby parameter and a lack of prepared statements in the plugin's SQL query logic, specifically in src/admin/email-list/class-table.php at line 439. An authenticated attacker with Administrator-level access can append additional SQL queries to existing ones, enabling data extraction from the WordPress database. The attack vector is network-based with low complexity, requiring no user interaction beyond the attacker's own authenticated session (Wordfence, Red Hat CVE).

Successful exploitation allows an authenticated administrator-level attacker to extract sensitive information from the WordPress database, including user credentials, email logs, and other stored data. The impact is limited to confidentiality (no integrity or availability impact), and the scope is unchanged, meaning exploitation is confined to the affected application's database. While lateral movement is not directly enabled, exposure of database credentials or sensitive user data could facilitate further attacks (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-10047. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability requires Administrator-level authentication, significantly limiting the attacker pool. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Wordfence).

1. Authentication: Log in to the WordPress admin panel with an account holding Administrator-level privileges or higher.
2. Navigate to the Email Tracker plugin: Access the Email Tracker plugin's email log or list view within the WordPress admin dashboard.
3. Identify the vulnerable parameter: Locate the orderby parameter used in the email list table, which is passed to the backend SQL query without proper sanitization.
4. Craft a malicious payload: Append a SQL injection payload to the orderby parameter (e.g., orderby=column_name,(SELECT+1+FROM+(SELECT+SLEEP(5))a)--) to test for time-based blind injection, or use UNION-based payloads to extract data.
5. Extract sensitive data: Use tools such as sqlmap targeting the vulnerable endpoint with the --param-filter or --data options to automate extraction of WordPress database tables, including wp_users for credential hashes or email log data.
6. Exfiltrate results: Collect extracted data (e.g., usernames, password hashes, email content) for offline cracking or further exploitation (Wordfence).

• Logs: WordPress access logs showing unusual or malformed orderby parameter values in requests to the Email Tracker admin pages (e.g., containing SQL keywords like SELECT, UNION, SLEEP, --, or encoded equivalents).
• Database: Unexpected or anomalous database query patterns in MySQL slow query logs, particularly queries originating from the Email Tracker plugin's table class involving appended SQL fragments.
• Network: Repeated or automated HTTP requests to the WordPress admin email list endpoint with varying orderby values, potentially indicating automated SQL injection tooling (e.g., sqlmap user-agent strings in access logs).

Users should update the Email Tracker plugin to a version beyond 5.3.15, as the vulnerability affects all versions up to and including 5.3.15. The patch was introduced in the plugin's SVN repository (changeset 3416646). As a workaround, restrict administrator access to trusted users only and consider using a Web Application Firewall (WAF) to detect and block SQL injection attempts targeting WordPress admin endpoints (Wordfence, WordPress Changeset).

Wordfence disclosed and reported this vulnerability, including it in their weekly WordPress vulnerability report for October 20–26, 2025. No significant broader media coverage or notable researcher commentary beyond the standard disclosure process has been identified (Wordfence Blog).