Custom API for WP vulnerabilities

2 known vulnerabilities in Custom API for WP from miniOrange. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  Custom API for WP: Incorrect Privilege Assignment

  CVE-2025-54049Aug 20, 2025miniOrange

  Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.

• 9.3 Critical severity

  Custom API for WP: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-54048Aug 20, 2025miniOrange

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.