CVE-2025-4396: Relevanssi WordPress Plugin SQLi Vulnerability

CVE-2025-4396 Overview

The Relevanssi – A Better Search plugin for WordPress contains a time-based SQL Injection vulnerability in the cats and tags query parameters. This vulnerability affects all versions up to and including 4.24.4 (Free) and 2.27.4 (Premium). The flaw exists due to insufficient escaping of user-supplied parameters and a lack of adequate preparation on existing SQL queries. This allows unauthenticated attackers to append additional SQL queries to extract sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the WordPress database, potentially including user credentials, personal information, and site configuration data.

Affected Products

• Relevanssi – A Better Search (Free) versions up to and including 4.24.4
• Relevanssi – A Better Search (Premium) versions up to and including 2.27.4
• WordPress installations using affected Relevanssi plugin versions

Discovery Timeline

• May 13, 2025 - CVE-2025-4396 published to NVD
• May 13, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4396

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the Relevanssi WordPress search plugin's taxonomy query handling functionality. The vulnerability is classified as a time-based SQL injection, meaning attackers can infer database content by observing response timing differences when injecting conditional SQL statements. The attack can be executed over the network without authentication, and while it does not allow data modification, it enables complete extraction of confidential database contents.

The vulnerable code paths are located in two key files within the plugin: search-tax-query.php and search.php. The cats and tags query parameters used for filtering search results by categories and tags do not properly sanitize user input before incorporating it into SQL queries. WordPress provides the $wpdb->prepare() function specifically to prevent SQL injection by properly escaping and type-casting query parameters, but this critical security measure is not adequately implemented in the affected code paths.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper use of SQL query preparation. The plugin fails to properly escape user-supplied values from the cats and tags query parameters before incorporating them into database queries. Instead of using WordPress's built-in prepared statement functionality ($wpdb->prepare()), the code directly concatenates user input into SQL strings, creating an injection point that attackers can exploit.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests containing SQL injection payloads in the cats or tags search parameters. By exploiting the time-based SQL injection technique, attackers send queries with conditional time delays (using functions like SLEEP() in MySQL). When the injected condition is true, the database pauses execution, and the attacker can observe the response delay to extract data one character or bit at a time.

The vulnerable code can be examined in the Relevanssi Search Tax Query Code and Relevanssi Search Code files in the WordPress plugin repository. These references show the exact locations where user input is processed without adequate sanitization.

Detection Methods for CVE-2025-4396

Indicators of Compromise

• Unusual database query execution times or timeout errors in WordPress logs
• HTTP requests to search endpoints containing SQL syntax in cats or tags parameters (e.g., SLEEP, BENCHMARK, UNION, single quotes, comment sequences)
• Repeated search requests from the same IP with incrementally modified parameter values
• Database server CPU spikes correlating with search endpoint access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in query parameters
• Monitor access logs for requests containing SQL keywords or time-based injection payloads in the cats and tags parameters
• Enable MySQL slow query logging to identify abnormally long-running queries originating from WordPress
• Deploy intrusion detection signatures for time-based SQL injection techniques

Monitoring Recommendations

• Configure real-time alerting for SQL injection patterns in web server logs
• Monitor database performance metrics for anomalous query execution times
• Review WordPress audit logs for suspicious search activity patterns
• Implement rate limiting on search endpoints to slow automated extraction attempts

How to Mitigate CVE-2025-4396

Immediate Actions Required

• Update Relevanssi (Free) to a version newer than 4.24.4 immediately
• Update Relevanssi (Premium) to a version newer than 2.27.4 immediately
• If updates are not immediately available, consider temporarily disabling the plugin
• Review WordPress database for signs of data exfiltration or unauthorized access

Patch Information

Security updates addressing this vulnerability should be obtained directly from the plugin author or the WordPress plugin repository. Administrators should check the Wordfence Vulnerability Report for the latest patch status and version information. Always verify the integrity of downloaded updates and test patches in a staging environment before production deployment.

Workarounds

• Temporarily disable the Relevanssi plugin until a patched version is available
• Implement WAF rules to block requests containing SQL injection patterns in the cats and tags parameters
• Restrict access to search functionality to authenticated users only if business requirements permit
• Consider using WordPress's native search functionality as a temporary alternative

# Configuration example - Block suspicious search parameters in Apache .htaccess
# Add to your WordPress root .htaccess file
RewriteEngine On
RewriteCond %{QUERY_STRING} (cats|tags)=.*(\%27|\'|\%22|\"|\%3D|=|sleep|benchmark|union) [NC]
RewriteRule ^.*$ - [F,L]