URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection

The SQL Injection vulnerability in the URL Shortener Plugin For WordPress poses a significant risk to WordPress websites utilizing this plugin. An attacker could exploit this flaw by manipulating the 'analytic_id' parameter to inject arbitrary SQL code. Successful exploitation could allow an attacker to bypass authentication, read sensitive data stored in the WordPress database (such as user credentials, post content, and configuration details), modify data, or even execute commands on the server. The potential impact extends to the compromise of the entire WordPress installation and any connected systems. This vulnerability shares similarities with other SQL Injection attacks, where attackers leverage database queries to gain unauthorized access.

WordPress websites utilizing the URL Shortener Plugin For WordPress, particularly those running older, unpatched versions (0.0.0–3.0.7), are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r "SELECT * FROM wp_options WHERE option_name = 'analytic_id'" /var/www/html/wp-content/plugins/url-shortener-plugin-for-wordpress/*

• generic web:

curl -I 'https://your-wordpress-site.com/?analytic_id='; # Check for unusual SQL syntax in the response headers

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'url-shortener-plugin-for-wordpress'

• wordpress / composer / npm:

wp plugin list --status=active | grep 'url-shortener-plugin-for-wordpress'

1. 2025-12-13Disclosure

   disclosure

1. आरक्षित2025-09-19
2. प्रकाशित2025-12-13
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-10738 is to immediately upgrade the URL Shortener Plugin For WordPress to a patched version once available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, implement a Web Application Firewall (WAF) rule to filter requests containing suspicious SQL syntax in the 'analytic_id' parameter. Regularly review WordPress database user permissions to limit the potential damage from a successful attack. Monitor WordPress access logs for unusual SQL query patterns.