4 matches found
CVE-2026-6295
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...
CVE-2026-6295 WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...
CVE-2026-6295
WP Optimizer (WordPress plugin) is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0 . The root cause is an unsafe subquery-detection branch in the Query::parse_key_compare_field() method: when a user-supplied value matches the regex ^[(\s]*SELECT\s+, it ...
EUVD-2026-83544
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...