CVE-2025-3951: WP-Optimize < 4.2.0 - Admin+ SQLi
Published Jun 2, 2025
·Updated
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.
Affected Software
2 affected components
WP-Optimize WP-Optimize<4.2.0
updraftplus Wp-optimize Wordpress<4.2.0
Event History
Jun 2, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-3951?
CVE-2025-3951 is classified as a high severity vulnerability that could allow SQL Injection attacks.
2
How do I fix CVE-2025-3951?
To fix CVE-2025-3951, update the WP-Optimize plugin to version 4.2.0 or later.
3
Who is affected by CVE-2025-3951?
CVE-2025-3951 affects WordPress installations using the WP-Optimize plugin versions prior to 4.2.0.
4
What types of attacks can be executed due to CVE-2025-3951?
CVE-2025-3951 can allow attackers with administrative privileges to perform SQL Injection attacks.
5
In what context does CVE-2025-3951 pose a risk?
CVE-2025-3951 poses a risk primarily in Multi-Site WordPress configurations.