| CVE ID | CVE-2026-5651 |
|---|---|
| Type | SQL Injection |
| Affected Component | WordPress Plugin Askeet |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| CVSS Score | 4.9 — Medium |
| Discovered by | Seckhmet |
A SQL Injection vulnerability was identified in the WordPress plugin Askeet — Talk to Your WooCommerce Data in all versions up to and including 3.0.
The flaw stems from the sql_query parameter used in multiple AJAX actions
(askeet_execute_sql_query and askeet_export_all_results). The
askeet_is_safe_query() filter is bypassable using MySQL conditional comments
(e.g. /*!UNION*/): the filter strips regular block comments before checking for forbidden SQL keywords, but
MySQL interprets conditional comments as executable code.
This bypass makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
A patch is available: it is strongly recommended to update the plugin to version 3.1 (or a newer version) as soon as possible.
For developers, this case illustrates the limits of a keyword blocklist approach: all SQL queries must use
prepared statements ($wpdb->prepare()) rather than pattern-based filtering. Allowing arbitrary
SQL queries to be executed from the admin interface is itself an attack surface that should be avoided.