{"id":82621,"date":"2025-10-12T09:29:29","date_gmt":"2025-10-12T09:29:29","guid":{"rendered":""},"modified":"2025-10-21T11:37:19","modified_gmt":"2025-10-21T17:37:19","slug":"cve-2025-10582-critical-sql-injection-vulnerability-in-wp-dispatcher-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-10582-critical-sql-injection-vulnerability-in-wp-dispatcher-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-10582: Critical SQL Injection Vulnerability in WP Dispatcher Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In this post, we will delve into a critical vulnerability identified as CVE-2025-10582 that affects the WP Dispatcher plugin for WordPress. This flaw is a SQL injection vulnerability that exists in all versions up to, and including, 1.2.0. It is of significant concern as it can potentially compromise the entire system or lead to sensitive<\/a> data leakage. The exploit of this vulnerability is possible for authenticated attackers who have Contributor-level access<\/a> or higher.
\nThe ramifications of this vulnerability are severe<\/a> for any organization or individual using affected versions of the WP Dispatcher plugin. Given the immense popularity of WordPress as a content management system, this vulnerability could potentially<\/a> affect a vast number of websites worldwide, making it a critical cybersecurity issue.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-10582
\nSeverity: Critical – 8.8 (CVSS score)
\nAttack Vector: Network
\nPrivileges Required: Low (Contributor-Level Access)
\nUser Interaction: Required
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

WP Dispatcher Plugin for WordPress<\/a> | Up to and including 1.2.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The WP Dispatcher Plugin for WordPress is vulnerable to a SQL injection<\/a> attack due to insufficient escaping on a user-supplied parameter and lack of enough preparation on the existing SQL query. Specifically, the ‘id’ parameter is not properly sanitized before being used in a SQL query.
\nThis vulnerability allows<\/a> an authenticated attacker with Contributor-level access or above to append malicious SQL queries into already existing queries. The attacker can craft a SQL query that manipulates the existing SQL query to extract sensitive information from the database, leading to potential<\/a> data leakage or even system compromise.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a hypothetical example of how the vulnerability might be exploited:<\/p>\n

POST \/wp_dispatcher?id=1;DROP TABLE users; HTTP\/1.1\nHost: vulnerable.wordpress.com\nContent-Type: application\/x-www-form-urlencoded\nuser=admin&password=password<\/code><\/pre>\n
In this example, the attacker appends a malicious SQL command (`DROP TABLE users;`) to the ‘id’ parameter in the HTTP request. If the server processes this request, it could result in the deletion of the ‘users<\/a>‘ table from the database, demonstrating the potential severity of this vulnerability.<\/p>\n
How to Mitigate<\/strong><\/p>\n
Users are strongly advised to apply the vendor patch immediately upon availability. In the meantime, users can use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation. Regularly updating all WordPress plugins<\/a> and core files to their latest versions can significantly reduce the risk of such vulnerabilities.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview In this post, we will delve into a critical vulnerability identified as CVE-2025-10582 that affects the WP Dispatcher plugin for WordPress. This flaw is a SQL injection vulnerability that exists in all versions up to, and including, 1.2.0. It is of significant concern as it can potentially compromise the entire system or lead to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[74],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-82621","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-sql-injection"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t