CVE-2025-10045: onOffice WordPress Plugin SQLi Vulnerability

CVE-2025-10045 Overview

CVE-2025-10045 is a SQL Injection vulnerability affecting the onOffice for WP-Websites plugin for WordPress. The flaw exists in all versions up to and including 6.5.1. It stems from insufficient escaping on the user-supplied order parameter and inadequate preparation of the underlying SQL query. Authenticated attackers with Editor-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials and configuration secrets. The vulnerability is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated Editor-level users can extract sensitive data from the WordPress database by injecting SQL through the order parameter.

Affected Products

onOffice for WP-Websites plugin for WordPress
All versions up to and including 6.5.1
WordPress sites where Editor-level accounts are provisioned to untrusted users

Discovery Timeline

2025-10-15 - CVE-2025-10045 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10045

Vulnerability Analysis

The onOffice for WP-Websites plugin exposes a real estate listing view backed by the RecordManagerReadListViewEstate.php component. This component accepts an order parameter that controls the sorting clause of the resulting SQL query. The plugin concatenates the order value into the SQL statement without proper escaping or parameterization through $wpdb->prepare().

Because the injection point sits inside an ORDER BY clause, standard prepared-statement placeholders cannot be applied without additional allow-listing. The plugin authors did not implement an allow-list of valid column names or sort directions. Attackers can therefore break out of the intended clause and append arbitrary SQL, including UNION SELECT payloads or time-based blind injection primitives.

Exploitation requires authentication at Editor role or above. This constraint limits mass exploitation but remains realistic on multi-author sites, marketing agency deployments, and any environment that provisions editorial access to contractors.

Root Cause

The root cause is direct concatenation of the order HTTP parameter into a dynamic SQL query without sanitization or use of a strict column allow-list. WordPress provides $wpdb->prepare() for parameterized queries, but placeholders do not cover identifier positions such as ORDER BY targets, so developers must validate these values against a known-good set. The plugin omitted this control.

Attack Vector

The attack vector is network-based over HTTP or HTTPS against the WordPress site. An authenticated attacker submits a crafted request that includes malicious SQL in the order parameter of the affected estate list view. Because the query executes with the WordPress database user's privileges, the attacker can read tables including wp_users and wp_usermeta. The impact is limited to confidentiality; integrity and availability are not directly affected according to the vector.

No public proof-of-concept exploit is currently listed for CVE-2025-10045. Technical details are available in the Wordfence Vulnerability Report and the corresponding WordPress Plugin Change Log.

Detection Methods for CVE-2025-10045

Indicators of Compromise

HTTP requests containing SQL keywords such as UNION, SELECT, SLEEP(, or information_schema inside the order query parameter targeting onOffice plugin endpoints.
Unusually long or URL-encoded values in the order parameter passed to pages rendering estate list views.
Database error responses or abnormal response-time variance correlated with requests from authenticated Editor sessions.
Access logs showing Editor-role sessions issuing repeated parameterized requests to plugin views in short intervals.

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that inspect the order parameter for SQL metacharacters on requests routed to onOffice plugin URLs.
Enable WordPress database query logging and alert on ORDER BY clauses containing subqueries or UNION operators.
Correlate authenticated user actions with database anomaly telemetry to surface Editor accounts issuing SQL-shaped payloads.

Monitoring Recommendations

Monitor authentication events for Editor and Administrator accounts, especially newly created ones, and review their request history against plugin endpoints.
Track outbound egress from the WordPress host for large row exports or unusual query result sizes.
Review MySQL slow query logs and general logs for statements that reference wp_users from within plugin execution contexts.

How to Mitigate CVE-2025-10045

Immediate Actions Required

Update the onOffice for WP-Websites plugin to a version later than 6.5.1 once the vendor publishes a fixed release, using the WordPress Plugin Change Log to confirm the patched revision.
Audit all WordPress accounts with Editor role or higher and remove access that is no longer required.
Rotate WordPress database credentials and secret keys if compromise is suspected.
Deploy WAF rules blocking SQL metacharacters in the order parameter for plugin routes.

Patch Information

The vendor addressed the vulnerable code in plugin/Record/RecordManagerReadListViewEstate.php per the referenced WordPress plugin changeset 3447130. Administrators should install the current stable release from the WordPress plugin directory and verify the patched file is present. Confirm the plugin version reported in the WordPress admin dashboard is greater than 6.5.1.

Workarounds

Temporarily deactivate the onOffice for WP-Websites plugin on sites that cannot be patched immediately.
Restrict Editor role assignment to trusted internal staff and require multi-factor authentication for those accounts.
Place the WordPress admin area behind an IP allow-list or VPN to reduce exposure of authenticated endpoints.
Enable a hardened WAF ruleset such as ModSecurity Core Rule Set with paranoia_level set to detect ORDER BY injection patterns.

bash

# Configuration example: block SQL keywords in the 'order' parameter at the web server
# nginx snippet
if ($arg_order ~* "(union|select|sleep\(|information_schema|--|/\*)") {
    return 403;
}