CVE-2025-10002 is a medium-severity SQL Injection vulnerability affecting the ClickWhale WordPress plugin, which is used for managing links, shortening URLs, and tracking affiliate link clicks. The vulnerability exists in the export_csv() function across all versions up to and including 2.5.0. The root cause is insufficient sanitization and escaping of user-supplied parameters combined with a lack of proper query preparation. This allows an authenticated attacker with Administrator-level privileges or higher to inject arbitrary SQL code into existing queries. The injection can be used to extract sensitive data from the underlying database, compromising confidentiality. Although the vulnerability requires high privileges, it may be exploitable by lower-privileged users if they have access to the plugin interface. The CVSS 3.1 score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No known exploits are reported in the wild yet. The vulnerability highlights the importance of proper input validation and use of parameterized queries in WordPress plugins handling sensitive data exports.

For European organizations using WordPress with the ClickWhale plugin, this vulnerability poses a risk of unauthorized data disclosure from their databases. Since the exploit requires administrator-level access, the threat is primarily from insider threats or attackers who have already compromised admin credentials. Successful exploitation could lead to leakage of sensitive affiliate tracking data, user information, or other confidential business data stored in the database. This could result in reputational damage, regulatory non-compliance (e.g., GDPR violations due to data exposure), and financial losses. Organizations relying on affiliate marketing and link tracking may face operational disruptions if data integrity is questioned. The medium severity score indicates a moderate risk, but the impact on confidentiality is significant enough to warrant prompt remediation. The lack of known exploits reduces immediate risk but should not lead to complacency.

European organizations should immediately audit their WordPress installations for the presence of the ClickWhale plugin and verify the version in use. If running version 2.5.0 or earlier, they should disable the plugin until a patched version is available or apply any vendor-provided fixes. In the absence of official patches, organizations can mitigate risk by restricting plugin access strictly to trusted administrators and monitoring for unusual database queries or export activities. Implementing Web Application Firewalls (WAFs) with SQL injection detection rules can provide additional protection. Regularly reviewing and rotating administrator credentials, enforcing multi-factor authentication, and limiting plugin usage to only necessary users will reduce exploitation likelihood. Additionally, organizations should consider database activity monitoring to detect anomalous query patterns indicative of injection attempts. Finally, maintaining up-to-date backups and an incident response plan will help mitigate potential damage if exploitation occurs.