WP Optimizer <= 2.5.0 — Authenticated (Administrator+) SQL Injection via 's' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 2.6.0, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to san6051.

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 18, 2026

   CVE published

   Severity medium, CVSS 4.9

2. Nov 13, 2026

   Record last updated