Overview
The CVE-2025-4396 vulnerability impacts the Relevanssi – A Better Search plugin for WordPress, exposing users to a potential SQL injection attack. This vulnerability is due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. As a result, unauthenticated attackers may exploit this flaw to append additional SQL queries, thereby extracting sensitive information from the database. It is critical to address this vulnerability to prevent potential system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-4396
Severity: High (7.5 CVSS)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage due to unauthorized extraction of sensitive information from database
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Relevanssi – A Better Search plugin for WordPress | Up to and including 4.24.4 (Free) and <= 2.27.4 (Premium) How the Exploit Works
This vulnerability stems from the inadequate escaping of user-supplied parameters in the ‘cats’ and ‘tags’ query parameters within the Relevanssi plugin. Lack of sufficient preparation on the existing SQL query allows unauthenticated attackers to append additional SQL queries to already existing ones. By exploiting this vulnerability, the attacker can manipulate the SQL statement and retrieve sensitive information from the database.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited using a maliciously crafted HTTP request.
GET /?s=test&cats=1%20UNION%20ALL%20SELECT%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20concat(user_login,%27|%27,user_pass)%20FROM%20wp_users%20--%20&tags=1 HTTP/1.1
Host: vulnerable-wordpress-site.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1In this example, the attacker uses an SQL UNION operator to append a query that retrieves user credentials from the ‘wp_users’ table. The ‘–‘ comments out the rest of the original SQL statement, making the appended query execute independently.
