PT-2025-42305 · WordPress · Outdoor

John Lee · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-10743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Outdoor plugin versions prior to 1.3.3

Description The Outdoor plugin for WordPress is susceptible to SQL Injection through the 'edit' action. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. An unauthenticated attacker can inject additional SQL queries into existing database queries, potentially extracting sensitive information. The edit action and the user-supplied parameter are involved in this issue.

Recommendations Update the Outdoor plugin to version 1.3.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10743

Affected Products

Outdoor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10743 · Security Note
• https://wordpress.org/plugins/outdoor · Note
• https://t.me/CVEtracker/34982 · Telegram Post
• https://twitter.com/CVEnew/status/1978545123563823266 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6038accc-98ac-496c-9c53-ec06b2045324?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1978430377732538510 · Twitter Post
• https://plugins.trac.wordpress.org/browser/outdoor/trunk/actions.php#L73 · Note