CVE-2026-5651 describes an SQL Injection vulnerability in the Askeet WordPress plugin (up to and including version 3.0). The flaw arises because the askeet_is_safe_query() filter, intended to prevent unsafe SQL commands, only strips regular block comments but fails to handle MySQL conditional comments (e.g., /*!UNION*/), which are interpreted as executable code by MySQL. This bypass allows authenticated users with Administrator privileges to append additional SQL queries via the 'sql_query' parameter in AJAX actions such as askeet_execute_sql_query and askeet_export_all_results, potentially exposing sensitive database information.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure, and requires high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to the vulnerable AJAX actions. Avoid using the affected plugin versions in sensitive environments.