CVE-2025-10740 is an SQL Injection vulnerability in the rupok98 URL Shortener Plugin for WordPress. The issue arises from a missing capability check in the verifyRequest function, which is part of the plugin's API. This allows authenticated users with low privileges (Subscriber-level and above) to perform unauthorized modifications to links managed by the plugin. The vulnerability affects all versions up to and including 3.0.7. The CVSS v3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

An attacker with Subscriber-level access or higher can exploit this vulnerability to modify links managed by the plugin, potentially leading to unauthorized changes in URL redirection or link behavior. This could affect the integrity and availability of the URL shortening service provided by the plugin. The confidentiality impact is low, as the primary issue is unauthorized modification rather than data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and consider disabling or limiting the use of the URL Shortener Plugin API functionality if possible to reduce risk.