CVE-2026-5651

Name of the Vulnerable Software and Affected Versions Askeet versions prior to 3.1

Description The Askeet plugin for WordPress contains a flaw allowing authenticated attackers with Administrator-level access and above to perform SQL Injection. The issue exists within the sql query parameter used in the askeet execute sql query() and askeet export all results() AJAX actions. This occurs because the askeet is safe query() filter can be bypassed using MySQL conditional comments, which are special comments that MySQL executes as code. While the filter removes standard block comments, it fails to account for conditional comments, enabling the execution of unauthorized SQL queries to extract sensitive database information.

Recommendations Update the plugin to a version later than 3.0. As a temporary mitigation, restrict access to the askeet execute sql query() and askeet export all results() functions.