Description
WordPress的Ultimate Auction Pro插件在1.5.2及之前所有版本中存在参数为‘auction_id'的SQL注入漏洞，该漏洞源于对用户提供参数转义不充分以及现有SQL查询缺乏充分预处理。这使得未经身份验证的攻击者能够向现有查询附加额外SQL语句，从而从数据库提取敏感信息。
Wordpress Plugin Ultimate Auction Pro /wp-admin/admin-ajax.php uwa_see_more_bids_ajax SQL 注入漏洞 （CVE-2025-4204）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cve.org/CVERecord?id=CVE-2025-4204
https://hackhalt.com/threat/cve-2025-4204/
https://www.ameeba.com/blog/cve-2025-4204-sql-injection-vulnerability-in-ultimate-auction-pro-wordpress-plugin/
https://www.sentinelone.com/vulnerability-database/cve-2025-4204/
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-woocommerce-auction-pro
https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2025-4204
https://cve.imfht.com/detail/CVE-2025-4204?lang=en
https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-4204&sortby=byriskscore&scoretype=vmscore
https://app.opencve.io/cve/?product=ultimate_wordpress_auction_plugin&vendor=auctionplugin