CVE-2026-5651: Askeet WordPress Plugin SQLi Vulnerability

CVE-2026-5651 Overview

CVE-2026-5651 is a SQL Injection vulnerability [CWE-89] in the Askeet plugin for WordPress affecting all versions up to and including 3.0. The flaw resides in the sql_query parameter used by the askeet_execute_sql_query and askeet_export_all_results AJAX actions. The plugin's askeet_is_safe_query() filter strips regular block comments before scanning for forbidden SQL keywords, but MySQL still executes conditional comments such as /*!UNION*/. Authenticated attackers holding Administrator-level access can append arbitrary SQL to existing queries and extract sensitive database contents.

Critical Impact
Administrator-authenticated attackers can bypass the plugin's SQL keyword filter using MySQL conditional comments to exfiltrate sensitive data from the WordPress database.

Affected Products

Askeet plugin for WordPress, versions up to and including 3.0
WordPress sites where the Askeet plugin AJAX actions askeet_execute_sql_query and askeet_export_all_results are reachable
Environments delegating Administrator access to untrusted users

Discovery Timeline

2026-08-05 - CVE-2026-5651 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-5651

Vulnerability Analysis

The Askeet plugin exposes two AJAX endpoints, askeet_execute_sql_query and askeet_export_all_results, that accept a sql_query parameter. The plugin attempts to guard these endpoints with a sanitizer named askeet_is_safe_query(). The sanitizer removes standard SQL block comments before searching the query for forbidden keywords such as UNION, INSERT, or UPDATE.

The sanitizer does not account for MySQL conditional comments of the form /*!...*/. MySQL treats content inside conditional comments as executable SQL when the optional version identifier is satisfied. An attacker submits payloads such as /*!UNION*/ SELECT ..., which the filter strips or ignores while MySQL still executes the underlying statement. This bypass allows appended queries to run in the context of the plugin's database connection.

Root Cause

The root cause is incomplete input sanitization in askeet_is_safe_query(). The function operates on the raw query string with a denylist approach and normalizes comments incorrectly. MySQL-specific comment syntax is not recognized, so keyword filtering happens against a version of the query that no longer matches what the database will execute. This is a classic denylist versus executable-parser mismatch that leads to CWE-89 SQL Injection.

Attack Vector

Exploitation requires an authenticated session with Administrator-level privileges or higher. The attacker sends a crafted POST request to the vulnerable AJAX action with a sql_query value containing MySQL conditional comments wrapping otherwise blocked keywords. The injected SQL executes against the WordPress database and results are returned through the plugin's normal response path or exported via askeet_export_all_results, enabling extraction of user credentials, session tokens, and other stored data.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset 3525593 for the patched code paths.

Detection Methods for CVE-2026-5651

Indicators of Compromise

HTTP POST requests to admin-ajax.php with action=askeet_execute_sql_query or action=askeet_export_all_results containing sql_query parameters
Request bodies containing MySQL conditional comment sequences such as /*!, /*!50000, or /*!UNION*/
Unexpected SELECT activity against wp_users, wp_usermeta, or wp_options originating from the plugin's database session
Large or unusual CSV exports generated by the askeet_export_all_results handler

Detection Strategies

Inspect web server and WordPress access logs for sql_query parameter values containing /*! sequences
Enable MySQL general or audit logging and alert on queries containing conditional comment markers issued from the WordPress user
Deploy WAF rules that decode URL-encoded payloads and match MySQL conditional comment patterns in POST bodies to admin-ajax.php

Monitoring Recommendations

Track administrator account activity, especially newly created administrators invoking Askeet AJAX endpoints
Alert on outbound data transfers or file downloads correlated with askeet_export_all_results responses
Baseline normal query volume from the WordPress database user and flag deviations tied to plugin AJAX calls

How to Mitigate CVE-2026-5651

Immediate Actions Required

Update the Askeet plugin to the version released in WordPress Plugin Changeset 3525593, which supersedes version 3.0
Audit WordPress user accounts and remove unnecessary Administrator-level access
Rotate credentials, secrets, and API keys stored in the WordPress database if exploitation is suspected
Review recent invocations of askeet_execute_sql_query and askeet_export_all_results in access logs

Patch Information

The vendor addressed the flaw in the update tracked by WordPress Plugin Changeset 3525593. Reference the patched source at askeet.php line 767 and the WordPress Plugin Overview for the current release. Additional technical context is available in the Wordfence Vulnerability Analysis.

Workarounds

Deactivate the Askeet plugin until it can be updated to the fixed release
Restrict access to wp-admin/admin-ajax.php for the askeet_execute_sql_query and askeet_export_all_results actions using WAF or web server rules
Add WAF signatures that block requests containing MySQL conditional comment syntax (/*!) in the sql_query parameter
Enforce least-privilege on the WordPress database user so it cannot read tables outside the plugin's scope

bash

# Configuration example
# Example ModSecurity rule to block MySQL conditional comments in Askeet AJAX calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1005651,msg:'CVE-2026-5651 Askeet SQLi bypass attempt'"
  SecRule ARGS:action "@rx ^askeet_(execute_sql_query|export_all_results)$" "chain"
    SecRule ARGS:sql_query "@rx /\*!" "t:none,t:urlDecodeUni,t:lowercase"