CVE-2025-10048

Name of the Vulnerable Software and Affected Versions My auctions allegro plugin for WordPress versions through 3.6.31

Description The software contains a SQL Injection issue due to insufficient escaping of the order parameter and inadequate preparation of the SQL query. This allows authenticated attackers with Administrator-level access or higher to append SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is order.

Recommendations Update the My auctions allegro plugin for WordPress to a version later than 3.6.31.