WP Optimizer CVE-2026-6295

Requires an authenticated WordPress administrator (PR:H) able to reach the search functionality that feeds the 's' parameter into Query::parse_key_compare_field(); the payload must match the regex ^[(\s]*SELECT\s+ so the value takes the vulnerable subquery-detection branch (which wraps it in parentheses and embeds it raw), and it must avoid single quotes since wp_magic_quotes only neutralizes those. Affected only in WP Optimizer (sh1zen) versions up to and including 2.5.0. The dominant limiting factor is the administrator privilege requirement: admins already have extensive legitimate database access in WordPress, greatly reducing real-world attacker benefit and confining realistic risk to privilege-boundary edge cases (e.g., multisite or restricted-admin setups) or post-compromise data theft.

This is a classic high-CVSS-subcomponent-but-low-real-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.9 Medium) is internally consistent with the description: network-reachable, low complexity, no user interaction, but explicitly gated behind PR:H (administrator-level access). The single most important limiting signal is that only WordPress administrators can reach the vulnerable 's' parameter path - and administrators in WordPress already possess broad, legitimate database access (e.g., via plugin/theme editors, custom queries, or trivial capability abuse), which sharply diminishes the practical value of an admin-only SQLi. No EPSS score, KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or ready-made tooling. The C:H (confidentiality) rating is defensible for a time-based blind extraction primitive, but I:N/A:N correctly reflects that this is a read-only disclosure vector. Net: real but low priority - patch in routine cycles rather than treating as urgent, because the admin precondition means an attacker who can trigger this could typically already read the database by other means.

An attacker who has already obtained WordPress administrator access (via stolen credentials, session hijack, or a rogue admin) submits a search request whose 's' parameter begins with a subquery pattern like '(SELECT ...' matching the ^[(\s]*SELECT\s+ regex. The plugin embeds this value unescaped into the SQL statement, letting the attacker run time-based blind subqueries to exfiltrate data such as user password hashes or secrets from the database. No public exploit code is identified at time of analysis, and exploitation requires administrator privileges, so this is not a mass-exploitable remote vector.