Executive brief
WP Optimizer is a plugin for WordPress that optimizes site performance. The plugin contains a SQL injection vulnerability in its search functionality that allows authenticated administrators to run arbitrary database queries. An attacker with admin privileges could extract sensitive data from the WordPress database, including user credentials, private posts, and other confidential information.
Technical details
The vulnerability exists in the Query::parse_key_compare_field() method, which fails to properly escape SQL when the 's' search parameter matches the regex ^[(\s]*SELECT\s+. The unsafe code path bypasses WordPress's standard esc_sql() and esc_like() protections by wrapping attacker-controlled SELECT statements directly in parentheses and embedding them in the SQL query. Authenticated attackers with administrator-level access can inject time-based blind SQL subqueries to exfiltrate database contents.
Affected products
- WP Optimizer WP Optimizer up to and including 2.5.0
Timeline
- 2026-09-19: disclosed