Miniorange Custom API For Wp vulnerabilities

2 CVEs affecting Miniorange Custom API For Wp, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-54049, published 2025-08-20.

More from Miniorange.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-54048, published 2025-08-20. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API…
• CVE-2025-54049, published 2025-08-20. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.