PT-2025-42279 · WordPress · Onoffice For Wp-Websites

Đức Tài · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-10045

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions onOffice for WP-Websites plugin versions up to and including 5.7

Description The onOffice for WP-Websites plugin for WordPress is susceptible to SQL Injection due to inadequate input sanitization and query preparation. Specifically, the order parameter is not properly escaped, allowing authenticated attackers with Editor-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database. The vulnerable parameter is order.

Recommendations Update the onOffice for WP-Websites plugin to a version newer than 5.7.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10045

Affected Products

Onoffice For Wp-Websites

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10045 · Security Note
• https://twitter.com/CVEnew/status/1978562040579928273 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3447130/onoffice-for-wp-websites/trunk/plugin/Record/RecordManagerReadListViewEstate.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve · Note
• https://t.me/cveNotify/138720 · Telegram Post
• https://plugins.svn.wordpress.org/onoffice-for-wp-websites/tags/5.7/plugin/Record/RecordManagerReadListViewEstate.php#97 · Note
• https://twitter.com/VulmonFeeds/status/1978499492765692035 · Twitter Post