CVE-2026-6295

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/modules/supporters/activity-log/ActivityLog_Table.class.php#L343
https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/vendors/wps-framework/Query.class.php#L455
https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/modules/supporters/activity-log/ActivityLog_Table.class.php#L343
https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/vendors/wps-framework/Query.class.php#L455
https://plugins.trac.wordpress.org/changeset/3508033
https://www.wordfence.com/threat-intel/vulnerabilities/id/4da302ab-8a5d-481b-8b28-a798e0982893?source=cve

Configurations

No configuration.

History

19 Sep 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-19 08:16

Updated : 2026-09-21 13:33

NVD link : CVE-2026-6295

Mitre link : CVE-2026-6295

CVE.ORG link : CVE-2026-6295

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-6295", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6295", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-19T13:23:44.016400Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "sh1zen", "product": "WP Optimizer \u2013 PageSpeed, Cache, Minify & Core Web Vitals", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-19T08:16:54.340", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/modules/supporters/activity-log/ActivityLog_Table.class.php#L343", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/vendors/wps-framework/Query.class.php#L455", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/modules/supporters/activity-log/ActivityLog_Table.class.php#L343", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/vendors/wps-framework/Query.class.php#L455", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3508033", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4da302ab-8a5d-481b-8b28-a798e0982893?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\\s]*SELECT\\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries \u2014 including time-based blind payloads \u2014 that can be used to extract sensitive information from the database."}], "lastModified": "2026-09-21T13:33:33.387", "sourceIdentifier": "security@wordfence.com"}