{"id":"CVE-2026-6295","published":"2026-09-19T08:16:54.340","lastModified":"2026-09-21T13:33:33.387","description":"The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\\s]*SELECT\\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.","cvssScore":4.9,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/modules/supporters/activity-log/ActivityLog_Table.class.php#L343","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/vendors/wps-framework/Query.class.php#L455","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/modules/supporters/activity-log/ActivityLog_Table.class.php#L343","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/vendors/wps-framework/Query.class.php#L455","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3508033","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da302ab-8a5d-481b-8b28-a798e0982893?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}