CVE-2026-6295

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1

Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field() function of the Query class, where a subquery-detection branch fails to escape or quote user-supplied values that match the regex ^[(s]*SELECTs+. This bypasses standard protections like esc sql() and wp magic quotes(), allowing the injection of arbitrary SQL subqueries, such as time-based blind payloads, to extract sensitive database information.

Recommendations Update to a version newer than 2.5.0. Avoid using the 's' parameter in the affected plugin until the update is applied.