CVE-2025-10175: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2025-10175 affects WP Links Page WordPress plugin versions up to 4.9.6. This is an authenticated SQL injection vulnerability that can be exploited by users with Subscriber level access or higher. The vulnerability was discovered and publicly disclosed on October 10, 2025 (Wordfence Intel). The vulnerability has been assigned a CVSS score of 6.5, indicating a medium severity level.

The vulnerability is classified as an authenticated SQL injection, which means attackers need at least a Subscriber level account to exploit it. The CVSS score of 6.5 (Medium) suggests that while the vulnerability requires authentication, it could still pose a significant risk to affected systems (Wordfence Intel).

As an SQL injection vulnerability, successful exploitation could allow authenticated attackers to manipulate or extract data from the WordPress site's database. This could potentially lead to unauthorized access to sensitive information stored in the database (Wordfence Intel).

The plugin has been temporarily closed as of October 9, 2025, pending a full security review. Users are advised to disable and remove the plugin until a security fix is available (WordPress Plugin).