CVE-2025-10682
BaseFortify
Publication date: 2025-10-15
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpres | tariffuxx | 1.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10682 is a vulnerability in the Tariffuxx WordPress plugin version 1.4 that allows attackers to perform SQL Injection and unauthorized data manipulation. The issue arises because the plugin's AJAX handlers accept user input (such as the column name to update) without proper validation or authorization checks. This allows authenticated users with Contributor-level access or even unauthenticated users (due to some AJAX endpoints being accessible without login) to inject SQL commands or modify arbitrary database fields, potentially extracting sensitive information or altering tariff configurations. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access and manipulation of the database storing tariff configurations. Attackers can inject SQL commands to extract sensitive information or modify data without proper permissions. This could result in data breaches, loss of data integrity, and potential privilege escalation within the WordPress site, compromising the site's security and functionality. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized or suspicious AJAX requests to the WordPress plugin's AJAX endpoints, particularly those invoking the 'save_twl_data' action. Since the vulnerability involves SQL Injection via the 'edit_field' parameter in the 'tariffuxx_configurator' shortcode and AJAX calls, you can look for unusual HTTP requests with parameters like 'action=save_twl_data' and crafted 'edit_field' values. Commands to detect such activity could include using web server logs or network monitoring tools to filter requests. For example, using grep on Apache or Nginx logs: `grep 'action=save_twl_data' /var/log/apache2/access.log` or `grep 'action=save_twl_data' /var/log/nginx/access.log`. Additionally, monitoring for unexpected database queries or errors related to the 'tariffuxx_twl' table may help. However, no specific detection commands are provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Tariffuxx WordPress plugin to a version later than 1.4 where this vulnerability is fixed, or if no update is available, disabling or removing the plugin to prevent exploitation. Additionally, restricting access to the AJAX endpoints, especially 'wp_ajax_save_twl_data' and 'wp_ajax_nopriv_save_twl_data', by implementing proper authentication and authorization checks can mitigate the risk. Applying web application firewall (WAF) rules to block suspicious requests targeting these AJAX actions and sanitizing or validating user inputs against a whitelist can also help. Since the vulnerability allows unauthenticated users to manipulate database fields, ensuring that AJAX handlers verify user capabilities and implement nonce checks is critical. Until a patch is applied, monitoring and blocking suspicious requests is recommended. [1, 2]