CVE-2026-5651 describes an SQL Injection vulnerability in the Askeet plugin for WordPress (versions <=3.0). The flaw exists in the handling of the 'sql_query' parameter in AJAX actions 'askeet_execute_sql_query' and 'askeet_export_all_results'. The plugin uses the askeet_is_safe_query() filter to block dangerous SQL keywords by stripping regular block comments, but this filter is bypassable using MySQL conditional comments (e.g., /*!UNION*/), which MySQL executes as code. Authenticated users with Administrator privileges can exploit this to append additional SQL commands to existing queries, potentially extracting sensitive data from the database. There is no vendor advisory or patch currently available, and no known exploits in the wild.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks that allow unauthorized reading of sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to SQL query execution within the plugin. Avoid exposing the vulnerable AJAX actions to untrusted users.