SQL Injection Vulnerability in WP Optimizer Plugin for WordPress

CVE-2026-6295

What is CVE-2026-6295?

The WP Optimizer plugin for WordPress is prone to an SQL Injection vulnerability through the 's' parameter across all versions up to and including 2.5.0. This vulnerability arises from a flaw in the Query::parse_key_compare_field() method, where user-input values can manipulate SQL queries without proper escaping. Authenticated users with administrator privileges can exploit this flaw to inject arbitrary SQL subqueries, leading to potential exposure of sensitive information from the database. Given the lack of adequate security measures in the vulnerable code path, it is crucial for users to update to the latest version and apply all recommended security practices.

References