CVE-2025-4396

published 2025-05-13

CVE-2025-4396: The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to…

Priority P1 80 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.5 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
comesio	relevanssi_a_better_search	<= 4.24.4	—
relevanssi	relevanssi_premium	<= 2.27.5	—

Detection & IOCs extracted from sources · hover to see the quote

sigma

title: Relevanssi SQL Injection
detection:
  selection:
    - 'contains(query_string, "cats=")'
    - 'contains(query_string, "tags=")'
    - 'contains(query_string, "=5\'")
  filter:
    - 'contains(content_type, "text/html")'
    - 'contains(body, "relevanssi")'
condition: and

• → Monitor HTTP requests to WordPress sites for the 'cats' and 'tags' query parameters containing SQL injection payloads (e.g., time-based blind injection strings such as appended SLEEP() or BENCHMARK() calls). ↗
• → No authentication is required to exploit this vulnerability; treat any anomalous SQL-like content in 'cats' or 'tags' parameters from unauthenticated sessions as high-priority alerts. ↗
• → Look for response body containing 'relevanssi' combined with anomalous response times (indicative of time-based blind SQLi) as a detection signal.

• · The vulnerability affects Relevanssi Free up to and including version 4.24.4, and Relevanssi Premium up to and including version 2.27.5. Ensure version checks cover both plugin variants. ↗
• · The Sigma rule fragment from DOC 2 is incomplete/partial and should be treated as a detection starting point only; the full rule logic and field mappings need to be validated against your SIEM/log source before deployment.

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89