PT-2025-43587 · WordPress · Rapidresult

John Lee · Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-10748

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RapidResult plugin for WordPress versions up to and including 1.2

Description The RapidResult plugin for WordPress is susceptible to SQL Injection due to insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries. Specifically, the s parameter is vulnerable. This allows authenticated attackers with contributor-level permissions or higher to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update the RapidResult plugin to a version newer than 1.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10748

Affected Products

Rapidresult

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10748 · Security Note
• https://t.me/cveNotify/140137 · Telegram Post
• https://plugins.trac.wordpress.org/browser/rapidresult/tags/1.2/rapidresult.php#L112 · Note
• https://t.me/CVEtracker/35645 · Telegram Post
• https://twitter.com/CVEnew/status/1981643770119520330 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4e5d7d04-f73a-48ea-81e3-36a514c76cc6?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3383652 · Note