CVE-2025-10047 Overview
CVE-2025-10047 is a SQL injection vulnerability in the Email Tracker plugin for WordPress, which provides email logging, open tracking, analytics, and management features. The flaw resides in the handling of the orderby parameter, which is incorporated into SQL queries without sufficient escaping or query preparation. All versions up to and including 5.3.15 are affected. Authenticated users with Administrator-level privileges or higher can append arbitrary SQL to existing queries to extract data from the WordPress database. The issue is tracked under CWE-89.
Critical Impact
Administrator-level attackers can execute arbitrary SQL queries against the WordPress database, enabling extraction of user credentials, session tokens, and other sensitive stored data.
Affected Products
- Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin
- All plugin versions up to and including 5.3.15
- WordPress installations with the vulnerable plugin activated
Discovery Timeline
- 2025-10-22 - CVE-2025-10047 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2025-10047
Vulnerability Analysis
The Email Tracker plugin exposes a sortable listing interface that accepts an orderby request parameter. The plugin passes this value directly into an ORDER BY clause of a SQL statement without validating it against an allowlist of column names or using parameterized queries. Because ORDER BY clauses cannot be safely parameterized with standard prepared statement placeholders, developers must enforce strict allowlisting. This plugin does neither, allowing an attacker to inject arbitrary SQL fragments through the orderby value.
Exploitation requires Administrator-level authentication, which limits the practical attacker population but does not eliminate the risk. Compromised administrator accounts, insider threats, and multi-tenant WordPress installations where lower-trust administrators exist are realistic abuse scenarios. Successful injection can read any database content accessible to the WordPress database user, including wp_users password hashes and session tokens stored in wp_usermeta.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin concatenates the user-supplied orderby value into a query string and executes it through WordPress database functions without wrapping the value with sanitize_sql_orderby() or validating it against a fixed set of permissible column names.
Attack Vector
The attack vector is network-based through standard HTTP requests to the WordPress admin interface. An authenticated administrator submits a crafted orderby parameter containing SQL syntax such as a UNION SELECT or subquery. The injected SQL executes with the privileges of the WordPress database user. The vulnerability affects confidentiality only; integrity and availability impacts are not indicated by the CVSS vector.
No verified exploit code is publicly available. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the vendor fix details.
Detection Methods for CVE-2025-10047
Indicators of Compromise
- HTTP requests to WordPress admin endpoints containing SQL keywords in the orderby parameter, such as UNION, SELECT, SLEEP, BENCHMARK, or inline comments like /* and --.
- Unusual ORDER BY clauses in MySQL general query logs that reference tables other than those the Email Tracker plugin normally sorts.
- Spikes in database errors from the WordPress site logged in PHP or web server error logs following admin panel activity.
Detection Strategies
- Inspect web server access logs for admin requests referencing Email Tracker screens with orderby values that contain non-alphanumeric characters beyond underscores.
- Enable MySQL query logging on non-production systems to identify unexpected UNION or subquery patterns originating from the plugin.
- Deploy a Web Application Firewall (WAF) rule that blocks SQL meta-characters in the orderby query parameter for WordPress admin paths.
Monitoring Recommendations
- Monitor administrator account activity for logins from unfamiliar IP addresses or at unusual times that precede plugin page access.
- Alert on authentication failures followed by successful logins to administrator accounts, which may indicate credential compromise.
- Track plugin version inventory across WordPress sites to detect any installation still running Email Tracker 5.3.15 or earlier.
How to Mitigate CVE-2025-10047
Immediate Actions Required
- Update the Email Tracker plugin to the version released after 5.3.15 that contains the fix referenced in the WordPress Plugin Changeset.
- Audit WordPress administrator accounts and remove or demote any unnecessary high-privilege users.
- Rotate credentials and session secrets if any suspicious administrator activity is identified in logs.
Patch Information
The plugin maintainers have published a changeset addressing the SQL injection. Review the Wordfence Vulnerability Report for the fixed version number and apply the update through the WordPress plugin manager or WP-CLI. Confirm the installed version is above 5.3.15 after upgrading.
Workarounds
- Deactivate the Email Tracker plugin until the patched version is applied if immediate updating is not possible.
- Restrict access to the WordPress admin interface by IP allowlist at the web server or WAF layer to reduce the authenticated attack surface.
- Enforce multi-factor authentication for all administrator accounts to raise the cost of credential-based access to the vulnerable functionality.
# Update Email Tracker plugin via WP-CLI
wp plugin update email-tracker
# Verify installed version is above 5.3.15
wp plugin get email-tracker --field=version
# Temporary mitigation: deactivate the plugin
wp plugin deactivate email-tracker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
