CVE-2025-54048: WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP allows SQL Injection. This issue affects Custom API for WP: from n/a through 4.2.2.
Other sources
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54048?
CVE-2025-54048 is classified as a critical SQL Injection vulnerability affecting the miniOrange Custom API for WP.
How do I fix CVE-2025-54048?
To mitigate CVE-2025-54048, update the miniOrange Custom API for WP to a version above 4.2.2.
What systems are impacted by CVE-2025-54048?
CVE-2025-54048 affects miniOrange Custom API for WP versions up to and including 4.2.2.
What is SQL Injection in the context of CVE-2025-54048?
In the context of CVE-2025-54048, SQL Injection allows an attacker to execute arbitrary SQL commands through the vulnerable API.
Can CVE-2025-54048 be exploited remotely?
Yes, CVE-2025-54048 can be exploited remotely if the vulnerable API is exposed to the internet.