CVE-2025-10682: WordPress TARIFFUXX Plugin SQL Injection

CVE-2025-10682 Overview

CVE-2025-10682 is a SQL Injection vulnerability [CWE-89] affecting the TARIFFUXX plugin for WordPress in all versions up to and including 1.4. The flaw results from insufficient neutralization of user-supplied input passed directly into SQL queries. Authenticated attackers with Contributor-level access or higher can inject additional SQL through the id attribute of the tariffuxx_configurator shortcode. Successful exploitation allows extraction of sensitive information from the WordPress database.

Critical Impact
Authenticated Contributor-level users can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session data, and other confidential records.

Affected Products

TARIFFUXX plugin for WordPress versions ≤ 1.4
WordPress installations permitting Contributor-level or higher accounts
Sites embedding the tariffuxx_configurator shortcode

Discovery Timeline

2025-10-15 - CVE-2025-10682 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10682

Vulnerability Analysis

The vulnerability resides in the TARIFFUXX plugin's handling of the tariffuxx_configurator shortcode. When a user embeds the shortcode with an id attribute, the plugin passes the attribute value into a SQL query without sanitization or use of prepared statements. The affected code paths are documented in classes/Tariffuxx_admin.php and classes/Tariffuxx_twl.php, referenced in the WordPress Plugin Code Review for Tariffuxx_admin.php and the WordPress Plugin Code Review for Tariffuxx_twl.php.

Because WordPress Contributors can create draft posts containing shortcodes, an attacker with that role can craft input that alters the intended SQL query structure. The result is a UNION- or error-based extraction path exposing any table the database user can read.

Root Cause

The root cause is direct string concatenation of untrusted shortcode attribute values into SQL statements. The plugin does not use $wpdb->prepare() with placeholders or validate that the id attribute is numeric before it reaches the query layer. This classifies the flaw under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

Exploitation requires an authenticated session with at least Contributor privileges. The attacker creates or edits a post containing the tariffuxx_configurator shortcode and supplies a malicious id attribute. When the shortcode renders, the injected SQL is executed by the WordPress database backend. No user interaction beyond viewing the affected page is required, and the attack is fully network-reachable.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-10682

Indicators of Compromise

Post or page content containing tariffuxx_configurator shortcodes with non-numeric id values, SQL keywords, or comment sequences such as --, /*, or UNION SELECT.
Unexpected wp_users, wp_usermeta, or wp_options read patterns in database query logs originating from the WordPress web user.
New or recently promoted Contributor-level accounts that authored draft posts referencing the plugin shortcode.

Detection Strategies

Grep the wp_posts table for shortcode payloads: SELECT ID, post_author FROM wp_posts WHERE post_content LIKE '%tariffuxx_configurator%' and review the id attribute values.
Enable MySQL/MariaDB general query logging or slow query logging and alert on queries referencing TARIFFUXX table names combined with UNION, SLEEP(, or INFORMATION_SCHEMA.
Deploy web application firewall rules that flag shortcode attributes containing SQL metacharacters submitted through /wp-admin/post.php or /wp-admin/post-new.php.

Monitoring Recommendations

Monitor WordPress audit logs for Contributor-role users editing posts that contain the vulnerable shortcode.
Track database error rates and 500-response spikes on pages rendering plugin shortcodes, which often accompany SQLi probing.
Review authentication logs for newly registered accounts that immediately begin publishing shortcode-heavy drafts.

How to Mitigate CVE-2025-10682

Immediate Actions Required

Update the TARIFFUXX plugin to a version above 1.4 that incorporates WordPress Changeset #3465105.
If a patched version is not yet available for your deployment, deactivate and remove the TARIFFUXX plugin until it can be updated.
Audit Contributor, Author, and Editor accounts and revoke any that are unnecessary or unrecognized.

Patch Information

The vendor addressed the SQL Injection in WordPress Changeset #3465105. Administrators should update to the fixed release through the WordPress plugin dashboard or via WP-CLI using wp plugin update tariffuxx. Verify the installed version reports higher than 1.4 after the update completes.

Workarounds

Restrict shortcode use by removing the unfiltered_html capability and limiting who can add shortcodes to posts.
Deploy a web application firewall rule that blocks requests where tariffuxx_configurator shortcode attributes contain SQL syntax such as UNION, SELECT, or comment delimiters.
Enforce least-privilege database credentials so the WordPress database user cannot read unrelated schemas or execute administrative statements.

bash

# Update the plugin via WP-CLI
wp plugin update tariffuxx

# If no patched version is available, deactivate and remove
wp plugin deactivate tariffuxx
wp plugin uninstall tariffuxx

# Audit low-privilege accounts that can author shortcodes
wp user list --role=contributor --fields=ID,user_login,user_registered