CVE-2026-5651 in Askeet Plugin
Summary
by MITRE • 08/05/2026
The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_query, askeet_export_all_results) in all versions up to, and including, 3.0. This is due to the askeet_is_safe_query() filter being bypassable using MySQL conditional comments (e.g., /*!UNION*/). The filter strips regular block comments before checking for forbidden SQL keywords, but MySQL interprets conditional comments as executable code. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Askeet plugin for WordPress presents a critical SQL injection vulnerability affecting all versions up to and including 3.0, specifically targeting the 'sql_query' parameter within multiple AJAX actions including askeet_execute_sql_query and askeet_export_all_results. This vulnerability stems from a fundamental flaw in the plugin's input validation mechanism where the askeet_is_safe_query() filter can be circumvented through the strategic use of MySQL conditional comments such as /!UNION/. The security mechanism fails to account for the fact that MySQL interprets conditional comments as executable code rather than mere documentation, allowing attackers to bypass the intended protection measures.
The technical implementation of this vulnerability exploits a classic weakness in input sanitization where the plugin strips regular block comments from SQL queries before performing keyword filtering checks. However, this approach proves insufficient against advanced attack vectors utilizing MySQL's conditional comment syntax which operates at the database engine level rather than the application layer. Attackers with Administrator-level privileges or higher can leverage this bypass to inject malicious SQL code that gets appended to existing queries, effectively extending the original database operations with unauthorized commands. This creates a pathway for extracting sensitive information from the WordPress database including user credentials, configuration settings, and potentially other confidential data stored within the system.
The operational impact of this vulnerability is severe as it provides authenticated attackers with direct access to the underlying database infrastructure without requiring additional exploitation techniques. The attack vector specifically targets privileged users who already possess administrative capabilities, making the vulnerability particularly dangerous in environments where administrators have broad system access. This scenario represents a privilege escalation vulnerability classified under CWE-89 SQL Injection, where the attacker can manipulate database queries through malicious input that bypasses standard security controls. The implications extend beyond simple data theft to potential complete system compromise, as database-level access often provides attackers with the means to modify system configurations, create backdoor accounts, or exfiltrate comprehensive datasets.
Mitigation strategies should focus on implementing robust input validation mechanisms that properly handle MySQL conditional comments and other advanced SQL injection techniques. Organizations should immediately update to patched versions of the Askeet plugin if available, while also implementing additional security measures such as database query parameterization, input sanitization at multiple layers, and monitoring for unusual database access patterns. Security professionals should consider implementing web application firewalls with SQL injection detection capabilities and conduct regular security assessments of WordPress plugins to identify similar vulnerabilities that may exist in other third-party components. The ATT&CK framework categorizes this vulnerability under T1078 Valid Accounts and T1566 Phishing for Information, as the attack requires legitimate administrative credentials but leverages a technical weakness in the plugin's security implementation rather than social engineering approaches.