CVE-2026-6295: WP Optimizer SQL Injection Vulnerability

CVE-2026-6295 Overview

CVE-2026-6295 is a SQL Injection vulnerability in the WP Optimizer plugin for WordPress affecting all versions up to and including 2.5.0. The flaw resides in the Query::parse_key_compare_field() method, which contains an unsafe subquery-detection branch. When a user-supplied value matches the regex ^[(\s]*SELECT\s+, the method wraps the value in parentheses and embeds it directly into the SQL string without escaping or quoting. Authenticated attackers with administrator-level access can inject arbitrary SQL subqueries, including time-based blind payloads, to extract sensitive data from the WordPress database. The issue is categorized as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Administrator-level attackers can execute arbitrary SQL subqueries against the WordPress database, enabling extraction of credentials, session tokens, and other sensitive records.

Affected Products

WP Optimizer plugin for WordPress — all versions up to and including 2.5.0
WordPress installations using the wps-frameworkQuery class from WP Optimizer
Sites exposing the plugin's activity-log s search parameter to administrator users

Discovery Timeline

2026-09-19 - CVE-2026-6295 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-6295

Vulnerability Analysis

The vulnerability is triggered through the s search parameter processed by ActivityLog_Table.class.php and evaluated inside Query::parse_key_compare_field() in the plugin's wps-frameworkQuery.class.php. The normal LIKE code path sanitizes input using esc_sql($wpdb->esc_like(...)) and wraps values in single quotes. A conditional branch detects values that appear to be subqueries by matching the regex ^[(\s]*SELECT\s+ and treats them as raw SQL fragments. When this branch executes, the plugin wraps the attacker-supplied value in parentheses and concatenates it directly into the query string. No escaping, quoting, or parameterization is applied on this path.

Root Cause

The root cause is a broken input trust boundary inside parse_key_compare_field(). The subquery-detection heuristic assumes that any string beginning with SELECT originates from trusted internal callers, but the same code path is reachable from HTTP request parameters. Because the injected payload contains no single quotes, WordPress's wp_magic_quotes() normalization applies no defensive escaping. The result is direct string concatenation of attacker-controlled SQL into a live query.

Attack Vector

Exploitation requires an authenticated administrator session on the target WordPress site. The attacker submits a crafted s parameter beginning with SELECT to the activity-log search endpoint. The plugin embeds the subquery unmodified into the compiled SQL statement, producing an executable inner query. Blind extraction is possible through time-based payloads that use SLEEP() or conditional delays. See the Wordfence Vulnerability Analysis and the WordPress Plugin Query Class source for the affected code path.

// No verified proof-of-concept code is published for CVE-2026-6295.
// Refer to the Wordfence advisory and the plugin source references
// for the vulnerable code path in Query::parse_key_compare_field().

Detection Methods for CVE-2026-6295

Indicators of Compromise

HTTP requests to WP Optimizer activity-log endpoints containing an s parameter whose value begins with (, whitespace, or the keyword SELECT.
Web server or WAF logs showing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, or INFORMATION_SCHEMA inside the s parameter.
Unusually long database query execution times correlated with administrator sessions viewing the activity log.

Detection Strategies

Inspect access logs for administrator-authenticated requests to WP Optimizer pages that include an s query parameter matching the regex ^[(\s]*SELECT\s+.
Enable MySQL general query logging or slow-query logging temporarily to identify parenthesized subqueries embedded in activity-log searches.
Correlate WordPress wp_users administrator activity with outbound anomalies, since exploitation requires an authenticated administrator account.

Monitoring Recommendations

Alert on any WordPress request parameter containing SQL verbs (SELECT, UNION, SLEEP) originating from authenticated admin sessions.
Monitor for new or unexpected administrator accounts, which are the prerequisite privilege for exploiting this issue.
Track WP Optimizer plugin version across the estate and flag installations at or below version 2.5.0.

How to Mitigate CVE-2026-6295

Immediate Actions Required

Update the WP Optimizer plugin to the version released after 2.5.0 that includes WordPress Change Set #3508033.
Audit WordPress administrator accounts and rotate credentials for any account that could have been used to exploit this issue.
Review WP Optimizer activity-log requests in the previous 90 days for s parameter values beginning with SELECT.

Patch Information

The maintainers addressed the flaw in the commit tracked as WordPress Change Set #3508033. The fix removes the unsafe subquery branch in Query::parse_key_compare_field() so that all user-supplied values are routed through the standard esc_sql($wpdb->esc_like(...)) sanitization and single-quote wrapping used by the LIKE path. Site owners should upgrade to the patched release referenced in the Wordfence Vulnerability Analysis.

Workarounds

Deactivate the WP Optimizer plugin until the patched version can be deployed.
Restrict administrator access to trusted personnel and enforce multi-factor authentication on all admin accounts.
Deploy a Web Application Firewall rule that blocks requests whose s parameter matches the regex ^[(\s]*SELECT\s+ for WP Optimizer endpoints.

bash

# Example ModSecurity rule to block subquery payloads in the 's' parameter
SecRule ARGS:s "@rx ^[(\s]*SELECT\s+" \
    "id:1026295,phase:2,deny,status:403,\
    msg:'CVE-2026-6295 WP Optimizer SQLi subquery pattern in s parameter'"