External risk intelligence

WordPress URL Shortener Plugin SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-10738

This vulnerability exists in a WordPress plugin designed to shorten and track URLs. Such plugins are intentionally deployed to process public web traffic and generate externally accessible links, making the vulnerable endpoint reachable from the internet as part of the normal operation of the website.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a WordPress plugin used for URL shortening and analytics. It allows attackers to inject malicious code to potentially access sensitive database information. While the impact is severe, the main concern is determining if this specific plugin is in use and, if so, confirming exposure.

Attackers can inject code into URL shortener data.
It could expose sensitive website information.
Confirm if the plugin is used and exposed.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to a WordPress site using the URL Shortener Plugin. The attacker would target the ‘analytic_id’ parameter, which lacks proper validation and sanitization, to inject malicious SQL code. This allows the attacker to manipulate existing database queries to steal sensitive information.

Accessible via the internet.
Injects SQL via a parameter.
Data extraction from database.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the WordPress URL Shortener Plugin could allow an unauthenticated attacker to access and potentially modify sensitive information stored in the website's database. The attacker could achieve this by manipulating the 'analytic_id' parameter to inject malicious SQL queries. This exposure could affect the integrity and confidentiality of database contents.

Sensitive WordPress database information at risk.
Attacker crafts malicious SQL queries via a parameter.
Potential for data theft and unauthorized modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in a WordPress plugin primarily impacts the website owner or the team responsible for managing the WordPress instance and its plugins. The first crucial step is to identify all WordPress sites utilizing this plugin, assess their exposure (e.g., if the vulnerable endpoint is publicly accessible), and determine their business criticality to prioritize remediation efforts.

Ownership: WordPress site administrators.
Verify first: Plugin installation and reachability.
Action: Plan maintenance for plugin updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the URL Shortener Plugin for WordPress?

This software is an extension for the WordPress content management system designed to create shortened, trackable links. It is typically used by site administrators to manage marketing campaigns or monitor user engagement by capturing click analytics. Because it functions by processing incoming web traffic to redirect users and log behavior, the plugin is architecturally designed to handle external requests as a core part of its utility.

How does CVE-2025-10738 work?

This issue is a SQL Injection, classified as CWE-89. The plugin fails to properly clean or sanitize input provided by users through the ‘analytic_id’ parameter before including it in a database command. Because the code does not use secure prepared statements, an attacker can insert their own database commands into that parameter. This tricks the website's database into executing unauthorized instructions, potentially revealing sensitive information stored in your site's tables.

Does any activity trigger this SQL injection?

An attacker must send a specially crafted request to the website that targets the vulnerable ‘analytic_id’ parameter. This bug is specifically tied to how the plugin handles that input. Simply visiting the website or clicking on a legitimate shortened link does not automatically trigger the vulnerability. The malicious action requires the attacker to actively supply manipulated input designed to break out of the intended database query structure.

Why is this a concern for my website?

Halo Surface Signal identifies this as a high-priority risk because the plugin is built to process public web traffic. Since the affected endpoint is reachable from the internet as part of normal operations, an attacker does not need special permissions or authentication to attempt an exploit. If your site uses this plugin, the vulnerable component is effectively exposed to any internet-based actor capable of sending a web request to your server.

What steps should I take if I use this plugin?

First, confirm whether your WordPress environment has this specific URL Shortener plugin installed and active. If it is present, treat the site as potentially vulnerable. Verify if the plugin offers a newer version that addresses this flaw and plan for an update immediately. If an update is not available, consider temporarily deactivating or removing the plugin until you can secure the functionality, as this will close the identified attack path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.