SQL Injection in Updraftplus Wp-Optimize
CVE-2025-3951
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.
Vulnerability class: SQL Injection
EPSS: 0.003 (19.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N.
Affected products
- Updraftplus Wp-optimize
- Unknown Wp-optimize — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2025-3951?
- CVE-2025-3951 is a medium-severity vulnerability in Updraftplus Wp-Optimize, classified under SQL Injection. CVSS score: 4.1/10. Published 2025-06-02.
- How severe is CVE-2025-3951?
- Medium severity. CVSS v3 base score is 4.1 out of 10.