CVE-2025-10652 Overview
CVE-2025-10652 is a SQL Injection vulnerability in the Robcore Netatmo plugin for WordPress. The flaw affects all plugin versions up to and including 1.7. The vulnerability exists in the module_id attribute of the robcore-netatmo shortcode, where user-supplied input is not properly escaped and the underlying SQL query lacks sufficient preparation. Authenticated users with Contributor-level access or higher can append additional SQL statements to existing queries. Successful exploitation allows attackers to extract sensitive information from the WordPress database, including user credentials, session tokens, and configuration data.
Critical Impact
Authenticated attackers with Contributor privileges can execute arbitrary SQL queries and exfiltrate sensitive database contents.
Affected Products
- Robcore Netatmo plugin for WordPress, versions up to and including 1.7
- WordPress sites with the plugin installed and Contributor-level accounts enabled
- Any deployment allowing untrusted users to author content containing shortcodes
Discovery Timeline
- 2025-09-20 - CVE-2025-10652 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10652
Vulnerability Analysis
The vulnerability is classified as SQL Injection under CWE-89. The Robcore Netatmo plugin registers a shortcode named robcore-netatmo that accepts a module_id attribute. When WordPress renders content containing this shortcode, the plugin passes the attribute value directly into a SQL query without escaping the input or using prepared statements. Because shortcodes are processed server-side during page rendering, any content author who can insert a shortcode into a post can inject SQL syntax through this attribute. The Contributor role in WordPress permits post creation, which is sufficient to trigger the injection path.
Root Cause
The root cause is insufficient input sanitization combined with unsafe SQL query construction. The plugin does not call esc_sql() or use $wpdb->prepare() with placeholders when incorporating the module_id attribute into the SQL query. This allows attacker-controlled input to break out of the intended query context and append additional SQL clauses such as UNION SELECT statements.
Attack Vector
Exploitation requires an authenticated account with Contributor privileges or higher. The attacker creates or edits a post containing the robcore-netatmo shortcode with a malicious module_id value. When the post is rendered, the injected SQL executes against the WordPress database. Attackers commonly use UNION-based or time-based blind injection techniques to extract data from the wp_users and wp_usermeta tables. Full technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Source Code.
Detection Methods for CVE-2025-10652
Indicators of Compromise
- Post or page content containing the robcore-netatmo shortcode with unusual module_id values such as SQL keywords, quote characters, or comment sequences (--, /*)
- Web server access logs showing POST requests to wp-admin/post.php or wp-admin/post-new.php from Contributor accounts followed by GET requests to pages rendering the affected shortcode
- Unexpected database queries in MySQL slow query or general query logs referencing UNION SELECT or information_schema from the WordPress database user
Detection Strategies
- Audit all posts and custom post types for occurrences of the robcore-netatmo shortcode and inspect the module_id attribute for injection payloads
- Enable MySQL query logging on the WordPress database and alert on queries containing UNION, SLEEP(, or information_schema originating from plugin execution paths
- Review WordPress user accounts with Contributor role or higher for recent creation, role changes, or unusual login activity
Monitoring Recommendations
- Deploy a web application firewall (WAF) with SQL injection signatures tuned to inspect shortcode attribute payloads inside POST bodies
- Monitor outbound network traffic from the WordPress host for large or unusual database export patterns
- Set alerts on WordPress audit logs for post edits containing shortcode syntax with SQL metacharacters in attribute values
How to Mitigate CVE-2025-10652
Immediate Actions Required
- Deactivate and remove the Robcore Netatmo plugin until a patched version is available, since all versions through 1.7 are affected
- Restrict Contributor-level and higher account creation, and review existing accounts for legitimacy
- Rotate WordPress administrator passwords, database credentials, and any secrets stored in wp_options if compromise is suspected
Patch Information
At the time of publication, no patched version of the Robcore Netatmo plugin has been identified in the referenced advisories. Site operators should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for updates. Until a fix is released, removing the plugin is the recommended remediation.
Workarounds
- Disable the robcore-netatmo shortcode by removing the plugin or by unregistering the shortcode through a custom mu-plugin using remove_shortcode('robcore-netatmo')
- Downgrade untrusted users from Contributor role to Subscriber, which cannot author posts containing shortcodes
- Deploy WAF rules that block requests containing SQL metacharacters within module_id shortcode attribute values
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate robcore-netatmo
wp plugin delete robcore-netatmo
# Audit posts for the vulnerable shortcode
wp post list --post_type=any --format=ids | \
xargs -I {} wp post get {} --field=content | grep -l 'robcore-netatmo'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
