PT-2025-37140 · WordPress · All In One Minifier

David Spruengli · Publicado 2025-09-11 · Atualizado 2025-09-16 · CVE-2025-9073

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: All in one Minifier plugin for WordPress versions prior to 3.3

Description: The All in one Minifier plugin for WordPress is susceptible to SQL Injection due to insufficient escaping of the post id parameter and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations: Update the All in one Minifier plugin to version 3.3 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-9073

Produtos afetados

All In One Minifier

Referências · 5

• https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php · Nota
• https://twitter.com/VulmonFeeds/status/1966109165379621056 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve · Nota
• https://twitter.com/cracbot/status/1967906352157589800 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-9073 · Nota de Segurança