PT-2025-38627 · WordPress · Robcore Netatmo Plugin For Wordpress

Published 2025-09-20 · Updated 2025-09-20 · CVE-2025-10652

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Robcore Netatmo plugin for WordPress versions up to and including 1.7

Description The Robcore Netatmo plugin for WordPress is susceptible to SQL Injection through the module id attribute of the robcore-netatmo shortcode. Insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries allow authenticated attackers with Contributor-level access or higher to append additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update the Robcore Netatmo plugin for WordPress to a version later than 1.7.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10652

Affected Products

Robcore Netatmo Plugin For Wordpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10652 · Security Note
• https://t.me/CVEtracker/32986 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ecd383f1-0546-4ff2-9f93-ee9d48ac3053?source=cve · Note
• https://twitter.com/CVEnew/status/1969291924423967044 · Twitter Post
• https://plugins.trac.wordpress.org/browser/robcore-netatmo/tags/1.7/inc/class_robcore_netatmo.php#L3 · Note
• https://plugins.trac.wordpress.org/browser/robcore-netatmo/tags/1.7/robcore-netatmo.php#L80 · Note