{"id":"CVE-2026-6295","title":"The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0","summary":"The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that,…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-89"],"vendor":"sh1zen","product":"WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals","affected":["wp_optimizer_pagespeed_cache_minify_core_web_vitals <= 2.5.0"],"published":"2026-09-19","updated":"2026-09-21","sourceUpdated":"2026-09-21T13:33:33.387","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6295","references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/modules/supporters/activity-log/ActivityLog_Table.class.php#L343","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/tags/2.3.8/vendors/wps-framework/Query.class.php#L455","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/modules/supporters/activity-log/ActivityLog_Table.class.php#L343","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimizer/trunk/vendors/wps-framework/Query.class.php#L455","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3508033","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da302ab-8a5d-481b-8b28-a798e0982893?source=cve","label":"security@wordfence.com"}],"tags":["nvd","cve.org"],"epss":0.00302,"epssPercentile":0.23087,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-19T13:23:44.016400Z"},"ingestedAt":"2026-09-19T07:59:56.110Z","slug":"CVE-2026-6295","body":"## Overview\n\nThe WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\\s]*SELECT\\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}