CVE-2025-10002 is an SQL Injection vulnerability in the ClickWhale WordPress plugin (versions up to 2.5.0) affecting the export_csv() function. The issue is due to improper neutralization of special elements in SQL commands (CWE-89), specifically insufficient escaping of user input and lack of prepared statements. This allows authenticated administrators to inject additional SQL queries, potentially extracting sensitive data from the database. The vulnerability requires high privileges (Administrator or above) and does not impact availability or integrity, only confidentiality. No known exploits in the wild have been reported, and no official patch or remediation guidance is currently available.

Successful exploitation allows an authenticated administrator-level user to perform SQL Injection attacks, leading to unauthorized disclosure of sensitive database information. The vulnerability does not affect data integrity or availability. Lower privilege users may only exploit this if granted access to the plugin. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access strictly to trusted administrators and monitor for suspicious activity. Avoid granting plugin access to lower privilege users. Follow vendor channels for updates on patches or official mitigations.