PT-2025-13710 · Unknown · Wphocus My Auctions Allegro

Published 2025-03-31 · Updated 2025-04-04 · CVE-2025-31542

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions wphocus My auctions allegro versions 3.6.20 and earlier

Description The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which affects the wphocus My auctions allegro software. This type of vulnerability occurs when user input is not properly sanitized, allowing an attacker to inject malicious SQL code. The estimated number of potentially affected devices worldwide is not available. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions 3.6.20 and earlier, update to a version that includes a fix for the SQL Injection vulnerability. As a temporary workaround, consider restricting user input to prevent malicious SQL code injection until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-31542

Affected Products

Wphocus My Auctions Allegro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-31542 · Security Note
• https://twitter.com/CveFindCom/status/1906693599913271462 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/my-auctions-allegro-free-edition/vulnerability/wordpress-my-auctions-allegro-plugin-3-6-20-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1908112432339243388 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/my-auctions-allegro-free-edition/vulnerability/wordpress-my-auctions-allegro-plugin-3-6-20-sql-injection-vulnerability?_s_id=cve · Note