Vulnerability-Lookup - Search a vulnerability

Vulnerabilites related to clickwhale - ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages

CVE-2025-10002 (GCVE-0-2025-10002)

Vulnerability from cvelistv5

Published

2025-09-20 04:27

Modified

2025-09-22 15:06

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.

References

▼	URL	Tags
	https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=cve
	https://plugins.trac.wordpress.org/changeset/3361848/clickwhale/trunk/includes/admin/Clickwhale_Ajax.php

Impacted products

	Vendor	Product	Version
	clickwhale	ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages	Version: * ≤ 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-22T15:06:41.331596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-22T15:06:52.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links \u0026 Link Pages",
          "vendor": "clickwhale",
          "versions": [
            {
              "lessThanOrEqual": "2.5.0",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Naoya Takahashi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links \u0026 Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-20T04:27:56.228Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3361848/clickwhale/trunk/includes/admin/Clickwhale_Ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-09-05T08:26:43.000+00:00",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-09-19T15:50:33.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "ClickWhale \u003c= 2.5.0 - Authenticated (Admin+) SQL injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-10002",
    "datePublished": "2025-09-20T04:27:56.228Z",
    "dateReserved": "2025-09-04T18:21:57.134Z",
    "dateUpdated": "2025-09-22T15:06:52.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-51715 (GCVE-0-2024-51715)