Description

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-19T08:16:54.340Z",
  "pubdate": "2026-09-19T08:16:54.340Z",
  "executiveSummary": "The WP Optimizer plugin for WordPress contains a critical SQL injection vulnerability in versions up to and including 2.5.0.\nThe vulnerability originates from unsafe handling of user-supplied input in the 's' parameter, allowing an attacker to bypass standard sanitization routines.\nThis flaw enables authenticated attackers with administrator-level privileges to perform arbitrary SQL injection attacks against the WordPress database.\nThe impact includes the potential for unauthorized data extraction through time-based blind SQL injection techniques.\nBy leveraging this flaw, an attacker can manipulate database queries, potentially compromising sensitive information stored within the WordPress environment.\nSuccessful exploitation requires administrator-level access, which limits the initial attack surface, but significantly increases the risk profile of the compromised application.",
  "technicalDetails": "The vulnerability resides within the Query::parse_key_compare_field() method of the WP Optimizer plugin. The root cause is a flawed subquery-detection branch that fails to properly sanitize or quote user input.\nSpecifically, when the input provided via the 's' parameter matches the regular expression ^[(\\s]*SELECT\\s+, the code path immediately wraps the input in parentheses and concatenates it directly into the SQL query string.\nUnder standard conditions, the plugin uses esc_sql() and $wpdb->esc_like() to sanitize input; however, this specific branch bypasses these security controls entirely.\nSince the attack payload utilizes a SELECT statement without requiring single quotes, WordPress's native wp_magic_quotes() mechanism fails to intervene, as it only addresses single-quote-based escape sequences.\nThe attack flow proceeds as follows: An authenticated administrator submits a crafted 's' parameter containing an SQL subquery. The application receives this input and matches it against the vulnerable regex pattern. The plugin's logic then interprets this input as a legitimate subquery rather than a string literal, resulting in the direct injection of the attacker-supplied SQL into the database query engine.\nThis allows for the execution of complex SQL commands. Attackers can leverage this to conduct time-based blind SQL injection attacks, where the database's response latency is measured to infer the content of sensitive database fields or tables.\nThe scope of the vulnerability is limited to authenticated users with administrative privileges, meaning the threat vector relies on an initial compromise or the presence of a malicious actor within the administrative interface. The lack of parameterization in the vulnerable method renders the application susceptible to unauthorized data exfiltration and potential database manipulation, impacting the confidentiality and integrity of the affected WordPress site."
}