CVE-2026-6295: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in sh1zen WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.
AI Analysis
Technical Summary
CVE-2026-6295 describes an SQL Injection vulnerability in the WP Optimizer plugin for WordPress (versions up to 2.5.0). The flaw exists in the Query::parse_key_compare_field() method, where a subquery-detection branch improperly wraps user-supplied input matching the regex ^[(\s]*SELECT\s+ in parentheses and inserts it directly into the SQL query without escaping or quoting. This bypasses the normal protections applied in the LIKE code path and WordPress's magic quotes mechanism, allowing authenticated administrators to inject arbitrary SQL subqueries, including time-based blind payloads, to extract sensitive data from the database.
Potential Impact
An authenticated attacker with administrator privileges can exploit this vulnerability to inject arbitrary SQL subqueries. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect integrity or availability directly but poses a confidentiality risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 's' parameter in plugin usage.
CVE-2026-6295: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in sh1zen WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
Description
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.
CVSS v3.1
Score 4.9medium
Affected software
sh1zen
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6295 describes an SQL Injection vulnerability in the WP Optimizer plugin for WordPress (versions up to 2.5.0). The flaw exists in the Query::parse_key_compare_field() method, where a subquery-detection branch improperly wraps user-supplied input matching the regex ^[(\s]*SELECT\s+ in parentheses and inserts it directly into the SQL query without escaping or quoting. This bypasses the normal protections applied in the LIKE code path and WordPress's magic quotes mechanism, allowing authenticated administrators to inject arbitrary SQL subqueries, including time-based blind payloads, to extract sensitive data from the database.
Potential Impact
An authenticated attacker with administrator privileges can exploit this vulnerability to inject arbitrary SQL subqueries. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect integrity or availability directly but poses a confidentiality risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 's' parameter in plugin usage.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-14T18:07:55.496Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aae3e0255bf5e2cf54897d7
Added to database: 09/19/2026, 07:47:14 UTC
Last enriched: 09/19/2026, 08:02:15 UTC
Last updated: 09/19/2026, 23:23:37 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.