PT-2025-37140 · WordPress · All In One Minifier

David Spruengli · Published 2025-09-11 · Updated 2025-09-16 · CVE-2025-9073

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: All in one Minifier plugin for WordPress versions prior to 3.3

Description: The All in one Minifier plugin for WordPress is susceptible to SQL Injection due to insufficient escaping of the post id parameter and inadequate preparation of existing SQL queries. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations: Update the All in one Minifier plugin to version 3.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-9073

Affected Products

All In One Minifier

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9073 · Security Note
• https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php · Note
• https://twitter.com/VulmonFeeds/status/1966109165379621056 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve · Note
• https://twitter.com/cracbot/status/1967906352157589800 · Twitter Post