CVE-2025-26590: Complete Google SEO Scan SQLi Vulnerability

CVE-2025-26590 Overview

CVE-2025-26590 is a SQL Injection vulnerability in the Complete Google Seo Scan WordPress plugin developed by Nir. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. All versions of complete-google-seo-scan up to and including 3.5.1 are affected. An authenticated attacker with high privileges can manipulate SQL queries over the network to access sensitive database content or disrupt availability. The issue carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can inject arbitrary SQL statements through the plugin, exposing confidential WordPress database contents and degrading site availability.

Affected Products

Nir Complete Google Seo Scan WordPress plugin
Versions from n/a through <= 3.5.1
WordPress installations running the complete-google-seo-scan plugin

Discovery Timeline

2025-06-06 - CVE-2025-26590 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26590

Vulnerability Analysis

The Complete Google Seo Scan plugin fails to properly sanitize user-supplied input before incorporating it into SQL statements. This classic injection pattern allows attackers to alter the structure of database queries executed by the plugin. According to the Patchstack advisory, the flaw exists in all versions through 3.5.1.

Exploitation requires authenticated access with high privileges, which limits the attacker pool. However, once authenticated, the attacker can interact with the WordPress database through crafted requests. The scope change in the CVSS vector indicates the impact extends beyond the plugin itself to the underlying database and connected WordPress components.

The vulnerability primarily threatens confidentiality, with secondary impact on availability. Attackers can extract user credentials, session tokens, post metadata, and other sensitive records stored in the WordPress database.

Root Cause

The root cause is the absence of parameterized queries or proper escaping when the plugin builds SQL statements from request parameters. User-controlled input flows directly into query strings without using wpdb->prepare() or equivalent sanitization helpers. This permits an attacker to break out of the intended query context and append arbitrary SQL clauses.

Attack Vector

The attack vector is network-based. An authenticated administrative or high-privilege user submits crafted parameters to a plugin endpoint that builds SQL queries from the input. The injected payload modifies the query logic, enabling data extraction through UNION clauses, boolean-based blind techniques, or time-based methods. Refer to the Patchstack SQL Injection Report for advisory details.

Detection Methods for CVE-2025-26590

Indicators of Compromise

Unexpected SQL syntax (UNION SELECT, SLEEP(, OR 1=1) appearing in HTTP request parameters to complete-google-seo-scan endpoints
Anomalous database queries originating from the plugin's PHP execution context in MySQL slow query or general logs
Unusual outbound data volume from the WordPress host following administrative requests
New or modified administrator accounts in wp_users not tied to legitimate activity

Detection Strategies

Inspect web server access logs for plugin URLs containing SQL meta-characters such as single quotes, comment markers (--, #), and union keywords
Enable MySQL general query logging on staging instances to baseline normal plugin queries and flag deviations
Deploy a web application firewall (WAF) ruleset that flags SQL injection signatures targeting /wp-admin/admin.php?page=complete-google-seo-scan* paths

Monitoring Recommendations

Alert on administrator-level WordPress accounts issuing repeated parameterized requests to the plugin within short windows
Forward WordPress, PHP, and MySQL logs to a centralized SIEM for correlation with authentication events
Monitor for sudden growth in SELECT query volume or rows examined on the WordPress database server

How to Mitigate CVE-2025-26590

Immediate Actions Required

Disable the Complete Google Seo Scan plugin until a patched release above 3.5.1 is available from the vendor
Audit all WordPress administrator and editor accounts and reset credentials for users who could reach the vulnerable endpoint
Review database access logs for queries matching injection signatures since the plugin was installed
Restrict access to /wp-admin/ paths using IP allowlists or VPN-based access controls

Patch Information

No fixed version is listed in the advisory at the time of publication. The vulnerability affects all releases through 3.5.1. Monitor the Patchstack SQL Injection Report and the WordPress plugin repository for an updated release.

Workarounds

Remove the complete-google-seo-scan plugin directory from wp-content/plugins/ if a patch is not yet available
Apply WAF virtual patching rules that block SQL injection payloads targeting the plugin's request parameters
Enforce the principle of least privilege by limiting the number of users with administrator role in WordPress
Use a database account for WordPress with only the minimum required privileges, denying FILE and limiting INFORMATION_SCHEMA reads where feasible

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate complete-google-seo-scan
wp plugin delete complete-google-seo-scan