CVE-2025-10683: WordPress Easy Email Subscription SQLI Flaw

CVE-2025-10683 Overview

CVE-2025-10683 is a SQL Injection vulnerability affecting the Easy Email Subscription plugin for WordPress. The flaw exists in all versions up to and including 1.3. It resides in the handling of the uid parameter, which is passed into an SQL query without sufficient escaping or query preparation [CWE-89]. Authenticated attackers holding Administrator-level access or higher can append additional SQL statements to existing queries. This enables extraction of sensitive information from the underlying WordPress database.

Critical Impact
Authenticated Administrator-level users can execute arbitrary SQL statements against the WordPress database, leading to disclosure of stored credentials, user data, and configuration secrets.

Affected Products

Easy Email Subscription plugin for WordPress, versions up to and including 1.3
WordPress sites with the email-subscription-with-secure-captcha plugin installed
Any WordPress deployment where Administrator accounts may be shared or compromised

Discovery Timeline

2025-11-06 - CVE-2025-10683 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10683

Vulnerability Analysis

The vulnerability originates in the plugin's handling of the uid request parameter. The plugin accepts user-controlled input and concatenates it into an SQL query without applying WordPress's parameterized query APIs such as $wpdb->prepare(). As a result, an authenticated attacker with Administrator privileges can inject additional SQL syntax into the query context.

The injected statements execute with the same database privileges as the WordPress application user. This typically permits reading arbitrary tables including wp_users (which stores hashed credentials and email addresses) and wp_options (which stores site secrets and API keys). Because exploitation requires Administrator-level authentication, the primary risk scenarios involve compromised administrator credentials, insider misuse, or privilege chaining from a lower-severity flaw.

Root Cause

The root cause is insufficient escaping of the uid parameter combined with the absence of prepared statements in the affected SQL query. The plugin author did not wrap the query using $wpdb->prepare() with placeholders, nor did it validate that uid conformed to an integer or expected format before interpolation. This is a canonical instance of Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Attack Vector

Exploitation is network-based and requires authentication as an Administrator or higher. The attacker sends a crafted HTTP request to the plugin endpoint that consumes the uid parameter, appending SQL syntax such as UNION SELECT clauses or subqueries. No user interaction is required beyond the attacker's own request. The scope of impact is limited to database confidentiality; integrity and availability are not directly affected according to the published metrics.

See the Wordfence Vulnerability Report for additional technical detail on the affected code path.

Detection Methods for CVE-2025-10683

Indicators of Compromise

HTTP requests to plugin endpoints containing SQL metacharacters such as ', UNION, SELECT, or -- in the uid parameter.
Web server access logs showing abnormally long or URL-encoded uid values from authenticated Administrator sessions.
Unexpected database errors in WordPress debug logs referencing queries that include the uid parameter.
Outbound data transfers from the WordPress host following suspicious administrative activity.

Detection Strategies

Deploy a web application firewall rule that inspects the uid parameter for SQL injection patterns targeting the email-subscription-with-secure-captcha plugin path.
Enable WordPress query logging or MySQL general query log review to correlate suspicious queries with authenticated sessions.
Alert on Administrator account activity originating from unusual IP addresses or geolocations.

Monitoring Recommendations

Continuously monitor the plugin directory for the installed version and flag any host still running version 1.3 or earlier.
Track database queries touching wp_users, wp_usermeta, and wp_options outside of expected application flows.
Review Administrator account provisioning and multi-factor authentication (MFA) enrollment on a recurring basis.

How to Mitigate CVE-2025-10683

Immediate Actions Required

Update the Easy Email Subscription plugin to the version that includes the fix committed in WordPress Plugin Changeset 3388578.
Audit all WordPress Administrator accounts and rotate credentials for any account that may have been misused.
Enforce MFA on every Administrator-level account to reduce the risk of credential-based abuse.
Review recent database query logs for suspicious activity involving the uid parameter.

Patch Information

The vendor addressed the vulnerability in the plugin changeset published at WordPress Plugin Changeset 3388578. The fix introduces proper input handling and parameterized query construction for the affected SQL statement. Site operators should update to the latest available plugin release from the WordPress plugin repository.

Workarounds

Deactivate and remove the Easy Email Subscription plugin until the patched version can be deployed.
Restrict Administrator account membership to the minimum set of trusted users and enforce least privilege.
Configure a WAF policy that blocks non-numeric or SQL-metacharacter values submitted in the uid parameter to plugin endpoints.

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:uid "!@rx ^[0-9]+$" \
    "id:1010683,phase:2,deny,status:403,\
    msg:'CVE-2025-10683: Non-numeric uid parameter blocked'"