CVE-2025-10635

The Find Me On WordPress plugin through version 2.0.9.1 fails to sanitize and escape a parameter before incorporating it into a SQL statement. This lack of input validation allows an attacker to inject arbitrary SQL commands, a classic SQL injection vulnerability [1].

The vulnerability can be exploited by any authenticated user with at least the Subscriber role. The attacker does not need elevated privileges, as the vulnerable parameter is accessible within the plugin's functionality available to lower-privileged accounts [1].

Successful exploitation enables an attacker to execute arbitrary SQL queries against the WordPress database. This could lead to data exfiltration, modification, or deletion of database contents, including user credentials and sensitive site information [1].

As of the publication date, no fix is available for this vulnerability. The plugin may be considered abandoned or end-of-life, and users are advised to remove the plugin or apply a web application firewall rule to mitigate the risk [1].