EUVD-2026-53183
GHSA-w4cg-h4j3-3gf6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Exploitation requires WordPress admin credentials (PR:H); AJAX vector is network-accessible (AV:N) with no additional complexity once authenticated; impact is database read-only (C:H/I:N/A:N) with no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_query, askeet_export_all_results) in all versions up to, and including, 3.0. This is due to the askeet_is_safe_query() filter being bypassable using MySQL conditional comments (e.g., /*!UNION*/). The filter strips regular block comments before checking for forbidden SQL keywords, but MySQL interprets conditional comments as executable code. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The askeet_is_safe_query() function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., /*!UNION*/), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.
Technical ContextAI
The affected product is the Askeet - Talk to Your WooCommerce Data plugin by 2WS Technologies (CPE: cpe:2.3:a:2wstechnologies:askeet_-_talk_to_your_woocommerce_data:*:*:*:*:*:*:*:*), a WordPress plugin designed to give administrators direct SQL query access to their WooCommerce MySQL database. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), specifically a parser discrepancy: askeet_is_safe_query() removes standard block comments (/* ... */) before keyword-matching, but MySQL's conditional comment syntax (/*!keyword*/) survives that stripping step and is subsequently interpreted by the MySQL engine as executable SQL. This behavior is consistent across MySQL and MariaDB - the standard database backends for WordPress. The vulnerable code is visible in the plugin's AJAX handlers askeet_execute_sql_query and askeet_export_all_results at askeet.php line 767 (both trunk and the 2.5 tag), confirming the flaw spans the entire supported version history through 3.0. The plugin's raw query execution feature is the design premise, making a safe-query filter the sole defense - and that defense is insufficient.
RemediationAI
An upstream fix has been committed to the plugin's trunk repository (changeset: https://plugins.trac.wordpress.org/changeset?new=3525593%40askeet%2Ftrunk&old=3521172%40askeet%2Ftrunk); however, a specific tagged release version incorporating this fix has not been confirmed from the available data - update to the latest available version from the WordPress plugin repository (https://wordpress.org/plugins/askeet/) once a post-3.0 release is published, and verify the version number exceeds 3.0. As an immediate compensating control, administrators should audit which WordPress accounts hold Administrator-level roles and revoke any that are unnecessary, as PR:H means reducing the admin user count directly reduces exposure. Enforcing multi-factor authentication on all admin accounts mitigates the credential-compromise pathway. If the SQL query execution feature of Askeet is not operationally required, disabling or uninstalling the plugin eliminates the attack surface entirely at the cost of that plugin's functionality - this is the most effective short-term mitigation. Web application firewall rules blocking MySQL conditional comment patterns (e.g., /*!) in POST bodies can reduce automated exploitation risk but should not be relied upon as a primary control given WAF bypass techniques.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today