PT-2025-43035 · WordPress · Wordpress+1

Đức Tài · Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-10047

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress versions through 5.3.12

Description The Email Tracker plugin for WordPress is susceptible to SQL Injection via the orderby parameter. Insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries allow authenticated attackers with Administrator-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database.

Recommendations Update the Email Tracker plugin to a version newer than 5.3.12.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10047

Affected Products

Email Tracker

Wordpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10047 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416646%40email-tracker&new=3416646%40email-tracker&sfp_email=&sfph_mail= · Note
• https://plugins.svn.wordpress.org/email-tracker/trunk/src/admin/email-list/class-table.php%3A439 · Note
• https://t.me/cveNotify/139810 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ec4be524-a763-4f2b-8a1d-6189014b4d86?source=cve · Note
• https://t.me/CVEtracker/35477 · Telegram Post