CVE-2025-10582: 
WordPress vulnerability analysis and mitigation

CVE-2025-10582 is a SQL Injection vulnerability in the WP Dispatcher plugin for WordPress, affecting all versions up to and including 1.2.0. The flaw exists in the id parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation. It was published on October 3, 2025, and reported by Wordfence. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), assigned by Wordfence as the CNA (Wordfence, NVD).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is insufficient escaping of the user-supplied id parameter combined with a lack of prepared statements in the existing SQL query within the plugin's shortcode handler (admin/class-wp-dispatcher-shortcode.php, line 78). An authenticated attacker with at least Contributor-level access can append additional SQL queries to the existing query, enabling classic or blind SQL injection attacks over the network with low complexity and no user interaction required (Wordfence, WordPress Plugin Source).

Successful exploitation allows authenticated attackers to extract sensitive information from the WordPress database, including user credentials, personal data, and site configuration. The high CVSS scores across confidentiality, integrity, and availability indicate that attackers could also manipulate or delete database records, potentially compromising the entire WordPress site. In multi-tenant or shared hosting environments, database access could facilitate further lateral movement or privilege escalation (Wordfence, NVD).

1. Reconnaissance: Identify WordPress sites running the WP Dispatcher plugin (version ≤ 1.2.0) using tools like WPScan or by checking the plugin's readme file at wp-content/plugins/wp-dispatcher/readme.txt.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Locate the Vulnerable Parameter: Identify a page or post using the WP Dispatcher shortcode that passes the id parameter to the backend SQL query.
4. Craft SQL Injection Payload: Append a malicious SQL fragment to the id parameter (e.g., 1 UNION SELECT user_login, user_pass, 3 FROM wp_users--) to extract data from the WordPress database.
5. Extract Sensitive Data: Retrieve the query results (e.g., usernames and hashed passwords) from the application's response, then use offline tools to crack password hashes for further privilege escalation (Wordfence, WordPress Plugin Source).

• Network: Unusual HTTP requests containing SQL keywords (UNION, SELECT, FROM, --, OR 1=1) in the id parameter of requests to pages using the WP Dispatcher shortcode.
• Logs: WordPress or web server access logs showing repeated requests with encoded or anomalous id parameter values (e.g., URL-encoded SQL syntax); error logs showing unexpected database query failures.
• Database: Unexpected or unauthorized queries in the MySQL general query log targeting wp_users, wp_options, or other sensitive tables; unusual data reads from the database at atypical times.
• Process: Unexpected database connections or elevated query volumes from the WordPress application user account.

The primary remediation is to update the WP Dispatcher plugin to a version beyond 1.2.0, which should include proper input sanitization and use of prepared statements (Wordfence). If an immediate patch is unavailable, site administrators should consider temporarily deactivating the plugin. Additional hardening measures include restricting Contributor-level account creation, implementing a web application firewall (WAF) with SQL injection rules, and monitoring database access logs for suspicious activity (Feedly).

Wordfence published the vulnerability in their weekly WordPress vulnerability report covering September 29 – October 5, 2025, and included it in their threat intelligence database (Wordfence Weekly Report). RedPacketSecurity shared the CVE disclosure on social media shortly after publication, contributing to broader community awareness (RedPacketSec). Overall community reaction has been limited, consistent with the low EPSS score and absence of active exploitation.