CVE-2025-10002: ClickWhale WordPress Plugin SQL Injection

CVE-2025-10002 Overview

CVE-2025-10002 is a SQL Injection vulnerability [CWE-89] in the ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress. The flaw exists in the export_csv() function across all versions up to and including 2.5.0. Insufficient escaping of user-supplied input, combined with the lack of proper SQL statement preparation, allows authenticated attackers with Administrator-level access to append arbitrary SQL to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database. Lower-privileged users may also exploit the flaw if plugin access has been delegated to them.

Critical Impact
Authenticated administrators can inject SQL statements through the CSV export functionality and exfiltrate database contents, including credentials and configuration secrets stored in the WordPress backend.

Affected Products

ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages (WordPress plugin)
All versions up to and including 2.5.0
WordPress installations that grant plugin access to non-administrator roles

Discovery Timeline

2025-09-20 - CVE-2025-10002 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10002

Vulnerability Analysis

The vulnerability resides in the export_csv() function within the ClickWhale plugin's admin AJAX handler (includes/admin/Clickwhale_Ajax.php). The function accepts user-controlled input and interpolates it directly into a SQL query without proper parameter binding or escaping. Because the query is not prepared through the WordPress $wpdb->prepare() API, attacker-supplied data is treated as executable SQL rather than data.

Exploitation requires authenticated access at the Administrator level in a default configuration. In deployments where site owners delegate plugin management to lower-privileged roles, the exploitation barrier is reduced accordingly. The impact is scoped to confidentiality, as attackers can read data from the database including user metadata, session tokens, API keys stored in options tables, and password hashes.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The export_csv() handler concatenates or substitutes a user-supplied parameter into a raw SQL string. WordPress provides $wpdb->prepare() for parameterized queries, but the affected function bypasses this safeguard. The absence of both input sanitization and parameter preparation creates the injection primitive.

Attack Vector

An authenticated attacker sends a crafted AJAX request to the ClickWhale export endpoint. By appending SQL syntax such as UNION SELECT clauses to the vulnerable parameter, the attacker retrieves data from arbitrary tables in the WordPress database. The results are returned through the CSV export response or through blind exfiltration techniques such as time-based or boolean-based inference. Refer to the WordPress ClickWhale Changeset and the Wordfence Vulnerability Intel Report for the specific patched code paths.

Detection Methods for CVE-2025-10002

Indicators of Compromise

POST requests to admin-ajax.php with the ClickWhale export_csv action containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA.
Unusually large or slow CSV export responses generated by administrator sessions.
Web server logs showing single-quote, comment (--, #), or hex-encoded payloads in ClickWhale export parameters.

Detection Strategies

Deploy WordPress-aware web application firewall (WAF) rules that inspect ClickWhale AJAX parameters for SQL metacharacters.
Correlate administrator authentication events with subsequent export endpoint calls to identify anomalous export activity.
Review MySQL/MariaDB slow query logs and general query logs for queries originating from the ClickWhale plugin that contain unexpected UNION or subquery constructs.

Monitoring Recommendations

Enable audit logging for all administrator actions in WordPress using a plugin such as WP Activity Log.
Monitor for changes to the ClickWhale plugin files and version downgrades that could reintroduce the vulnerable code.
Alert on repeated 500-series responses from admin-ajax.php calls tied to the ClickWhale action, which can indicate injection probing.

How to Mitigate CVE-2025-10002

Immediate Actions Required

Update the ClickWhale plugin to a version later than 2.5.0 that includes the fix from changeset 3361848.
Audit WordPress user accounts and revoke Administrator privileges from accounts that do not require them.
Rotate credentials, API keys, and secrets stored in the WordPress database if exploitation is suspected.

Patch Information

The vendor addressed the vulnerability in the ClickWhale plugin trunk via changeset 3361848. The patch introduces proper input handling and query preparation in the export_csv() function within includes/admin/Clickwhale_Ajax.php. Site owners should upgrade through the WordPress plugin repository as soon as the fixed release is available.

Workarounds

Restrict access to the WordPress admin dashboard using IP allowlisting at the web server or WAF layer.
Temporarily disable or remove the ClickWhale plugin until the patched version is installed.
Enforce role-based access control so that only trusted administrators can invoke plugin AJAX endpoints.

bash

# Configuration example: restrict wp-admin access at the nginx layer
location ~ ^/wp-admin/admin-ajax.php {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}