Description
The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-10-03
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Database Compromise
Action: Immediate Patch
AI Analysis

Impact

The WP Dispatcher plugin for WordPress allows an authenticated user with Contributor or higher privileges to inject arbitrary SQL via the unsanitized 'id' parameter. The injection can append additional statements to the existing query, enabling the attacker to extract sensitive data from the database.

Affected Systems

The vulnerability affects the ekndev WP Dispatcher plugin for WordPress versions up to and including 1.2.0. Users running WordPress installations with this plugin installed before the 1.2.1 release are impacted.

Risk and Exploitability

The CVSS score of 8.8 categorizes this flaw as high severity. The EPSS score of < 1% suggests a low likelihood of exploitation in the wild, yet the lack of a CISA KEV listing does not negate its risk. Attackers must first authenticate and possess at least Contributor level access, after which they can craft malicious 'id' values to append SQL, potentially exfiltrating database contents.

Generated by OpenCVE AI on April 21, 2026 at 02:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WP Dispatcher plugin to version 1.2.1 or later, which removes the unsanitized input vulnerability.
  • If an update is not immediately possible, uninstall or deactivate the plugin to eliminate the attack surface, and deny Contributor-level users the ability to access the plugin’s admin pages.
  • Review user roles and restrict Contributor or higher privileges from the WordPress Admin area until the plugin is patched to reduce the opportunity for exploitation.

Generated by OpenCVE AI on April 21, 2026 at 02:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-32256 The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
History

Mon, 06 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 03 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 03 Oct 2025 11:30:00 +0000

Type Values Removed Values Added
Description The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title WP Dispatcher <= 1.2.0 - Authenticated (Contributor+) SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:14:11.848Z

Reserved: 2025-09-16T20:00:24.123Z

Link: CVE-2025-10582

cve-icon Vulnrichment

Updated: 2025-10-03T14:03:00.956Z

cve-icon NVD

Status : Deferred

Published: 2025-10-03T12:15:43.123

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-10582

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T02:45:25Z

Weaknesses