What is the CVSS score of CVE-2025-53314?

CVE-2025-53314 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of WP Optimizer are affected by CVE-2025-53314?

The sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) contains a critical SQL injection vulnerability exploitable via CSRF that could allow attackers to compromise your WordPress…

How to fix or mitigate CVE-2025-53314?

Within 24 hours, audit all WordPress installations for sh1zen WP Optimizer presence; if the plugin is not business-critical, disable and remove it immediately; if required, restrict WordPress admin panel access to specific IP ranges and enforce multi-factor authentication for all administrative accounts. Within 7 days, implement database activity monitoring for anomalous SQL queries, configure Web Application Firewall rules to block suspicious requests to the plugin, and conduct security awareness training for all privileged users emphasizing the risk of visiting untrusted links while logged into WordPress. Within 30 days, monitor the plugin vendor's advisory channel for patch availability; evaluate alternative WordPress optimization tools without known vulnerabilities; if sh1zen WP Optimizer remains in use pending patching, implement a formal compensating control audit.

WP Optimizer CVE-2025-53314

EUVD-2025-28511 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-27 audit@patchstack.com

WordPress SQLi CSRF Wordpress Plugin

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

vuln.today AI

9.6 CRITICAL

CSRF needs no attacker auth but requires a logged-in victim to click (PR:N, UI:R); resulting SQLi crosses into the database (S:C) yielding high confidentiality/integrity and limited availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-28511

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

CRITICAL 9.6

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer allows SQL Injection. This issue affects WP Optimizer: from n/a through 2.3.6.

AnalysisAI

SQL injection via Cross-Site Request Forgery in the sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) lets a remote attacker who lures a logged-in privileged user into visiting a malicious page forge a state-changing request that reaches an unsanitized SQL query. Rated CVSS 9.6 with a scope change, it can compromise the WordPress database, but exploitation hinges on user interaction and there is no public exploit and a negligible EPSS of 0.03%.

Technical ContextAI

The affected component is WP Optimizer, a WordPress performance/database-optimization plugin by sh1zen, running inside PHP on a WordPress site. The root cause is CWE-352 (Cross-Site Request Forgery): a sensitive plugin action lacks a valid anti-CSRF nonce check, so a forged request from an authenticated victim's browser is accepted as legitimate. Because the vulnerable handler passes attacker-influenced input into a SQL statement without proper parameterization or sanitization, the CSRF becomes a vector for SQL injection against the WordPress MySQL/MariaDB backend, chaining a request-forgery flaw into database-level data access and manipulation.

RemediationAI

No fixed version is stated in the available data, so upgrade to any release later than 2.3.6 once sh1zen publishes one and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-optimizer/vulnerability/wordpress-wp-optimizer-plugin-2-3-6-cross-site-request-forgery-csrf-vulnerability) for the patched version; treat this as "no vendor-released patch identified at time of analysis." As compensating controls, deploy a WAF or virtual patch (Patchstack offers one) to enforce nonce/referer validation on the plugin's endpoints, restrict wp-admin access to trusted IPs to shrink the pool of authenticated victims, and consider deactivating WP Optimizer until a fix ships - the trade-off being loss of its optimization functionality. Administrators should also avoid browsing untrusted sites while logged into WordPress, since that browser session is what a CSRF attack abuses.