CVE-2025-10582: WP Dispatcher Plugin SQLi Vulnerability

CVE-2025-10582 Overview

CVE-2025-10582 is a SQL Injection vulnerability in the WP Dispatcher plugin for WordPress, affecting all versions up to and including 1.2.0. The flaw resides in the handling of the id parameter, where user-supplied input is insufficiently escaped and the underlying SQL query lacks proper preparation. Authenticated users with Contributor-level access or higher can append arbitrary SQL statements to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database, including credentials, password hashes, and session tokens. The vulnerability maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated Contributor-level attackers can extract sensitive database contents from affected WordPress sites, including user credentials and confidential post data.

Affected Products

WordPress WP Dispatcher plugin versions 1.0.0 through 1.2.0
All WordPress sites with the WP Dispatcher plugin active
Installations where users hold Contributor-level access or higher

Discovery Timeline

2025-10-03 - CVE-2025-10582 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10582

Vulnerability Analysis

The WP Dispatcher plugin exposes a shortcode handler that accepts an id parameter and concatenates it directly into a SQL query. The plugin neither escapes the input with esc_sql() nor uses $wpdb->prepare() with parameter placeholders. Attackers supply crafted shortcode arguments through any post or content type they can author, causing the database engine to execute injected SQL.

Exploitation requires only Contributor-level authentication, which is commonly granted to guest writers and lower-trust users on multi-author WordPress sites. Because the injection executes server-side under the plugin's database privileges, attackers can run UNION SELECT queries to read arbitrary tables such as wp_users and wp_usermeta.

The attack vector is network-based and does not require user interaction. The vulnerability impacts confidentiality, integrity, and availability of the underlying WordPress database.

Root Cause

The vulnerable code path concatenates the id parameter into a SQL statement without parameterization. WordPress provides the $wpdb->prepare() API specifically to prevent this class of issue, but the plugin developer bypassed it for the affected query. The relevant code is referenced in the WordPress Plugin Code Review.

Attack Vector

An authenticated attacker with Contributor privileges submits a post or page containing a WP Dispatcher shortcode with a malicious id value. When the shortcode renders, the injected SQL fragment executes against the WordPress database. Time-based and union-based extraction techniques both apply. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-10582

Indicators of Compromise

Unexpected shortcode usage referencing the WP Dispatcher id parameter with SQL syntax such as UNION, SLEEP(, --, or 0x literals
WordPress posts authored by Contributor accounts that contain encoded SQL fragments in shortcode attributes
Database error log entries from wpdb referencing syntax errors during shortcode rendering
Outbound database queries against wp_users, wp_usermeta, or wp_options originating from shortcode execution

Detection Strategies

Audit all posts and pages for WP Dispatcher shortcodes containing non-numeric id values
Enable WordPress query logging and alert on UNION SELECT, INFORMATION_SCHEMA, or BENCHMARK( patterns in plugin-originated queries
Inspect web server access logs for POST requests to wp-admin/post.php from Contributor accounts that include suspicious shortcode payloads

Monitoring Recommendations

Monitor the wp_users and wp_usermeta tables for unexpected SELECT volume from PHP worker processes
Track Contributor and Author account activity for anomalous content submission patterns
Alert on WordPress error log entries containing MySQL server has gone away or syntax errors tied to the WP Dispatcher plugin

How to Mitigate CVE-2025-10582

Immediate Actions Required

Deactivate and remove the WP Dispatcher plugin until a patched version above 1.2.0 is released
Audit and restrict Contributor, Author, and Editor accounts to trusted users only
Rotate all WordPress user passwords and database credentials if exploitation is suspected
Review database query logs for evidence of UNION-based extraction since the plugin was installed

Patch Information

At the time of NVD publication, all versions up to and including 1.2.0 are affected. Administrators should monitor the WordPress WP Dispatcher Plugin page for an updated release that implements $wpdb->prepare() on the vulnerable query.

Workarounds

Remove the WP Dispatcher plugin from production sites where Contributor-level accounts exist
Apply a Web Application Firewall rule that blocks SQL keywords in shortcode parameters submitted via wp-admin
Restrict the unfiltered_html and post submission capabilities for low-trust roles
Place the WordPress administrative interface behind IP allow-listing or VPN access

bash

# Disable the WP Dispatcher plugin via WP-CLI
wp plugin deactivate wp-dispatcher
wp plugin delete wp-dispatcher

# Audit existing posts for suspicious shortcode usage
wp db query "SELECT ID, post_author, post_title FROM wp_posts \
  WHERE post_content LIKE '%wp-dispatcher%' \
  AND (post_content LIKE '%UNION%' OR post_content LIKE '%SLEEP(%');"