CVE-2025-10002: ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the exportcsv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10002?
CVE-2025-10002 is classified as a high severity vulnerability due to its potential for SQL Injection exploitation.
How do I fix CVE-2025-10002?
To fix CVE-2025-10002, upgrade to version 2.5.1 or later of the ClickWhale plugin.
What is SQL Injection in the context of CVE-2025-10002?
In the context of CVE-2025-10002, SQL Injection allows an attacker to manipulate database queries via the export_csv() function.
Which software is affected by CVE-2025-10002?
CVE-2025-10002 affects the ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress, version 2.5.0 and earlier.
Is there a workaround for CVE-2025-10002 before upgrading?
There is no official workaround for CVE-2025-10002; the recommended action is to update to the latest version.