CVE-2025-4396 – The Relevanssi WordPress plugin has a time-base... (How to Fix)

Q: What is the severity of CVE-2025-4396?

CVE-2025-4396 has a CVSS score of 7.5 (HIGH). The Relevanssi WordPress plugin has a time-based SQL injection vulnerability in its search functionality. Unauthenticated attackers can exploit this to extract sensitive data from the database by manipulating search parameters. All WordPress sites using vulnerable versions of Relevanssi are affected.

📋 TL;DR

The Relevanssi WordPress plugin has a time-based SQL injection vulnerability in its search functionality. Unauthenticated attackers can exploit this to extract sensitive data from the database by manipulating search parameters. All WordPress sites using vulnerable versions of Relevanssi are affected.

💻 Affected Systems

Products:

Relevanssi – A Better Search WordPress plugin

Versions: Free: up to and including 4.24.4, Premium: up to and including 2.27.4

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable Relevanssi versions are affected regardless of configuration.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including user credentials, personal data, and administrative access leading to site takeover.

🟠

Likely Case

Extraction of sensitive information like user emails, hashed passwords, and private content from the database.

🟢

If Mitigated

Limited data exposure if database permissions are properly restricted and sensitive data is encrypted.

🌐 Internet-Facing: HIGH - The vulnerability is exploitable by unauthenticated attackers via public search functionality.

🏢 Internal Only: LOW - The vulnerability requires access to the search interface, which is typically public-facing.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Time-based SQL injection requires more sophisticated exploitation than boolean-based but is still accessible to moderately skilled attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Free: 4.24.5+, Premium: 2.27.5+

Vendor Advisory: https://wordpress.org/plugins/relevanssi/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Relevanssi and click 'Update Now'. 4. Verify update completes successfully.

🔧 Temporary Workarounds

Disable Relevanssi plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate relevanssi

WAF rule for SQL injection

all

Implement web application firewall rules to block SQL injection patterns in search parameters

🧯 If You Can't Patch

Implement strict input validation and sanitization for all search parameters
Restrict database user permissions to read-only for the WordPress application user

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins → Relevanssi version

Check Version:

wp plugin get relevanssi --field=version

Verify Fix Applied:

Verify Relevanssi version is 4.24.5+ (Free) or 2.27.5+ (Premium) after update

📡 Detection & Monitoring

Log Indicators:

Unusual long-running database queries from search endpoints
Multiple failed SQL queries with time delays
Suspicious parameter values in search requests

Network Indicators:

HTTP requests to search endpoints with SQL keywords in parameters
Unusually slow response times from search functionality

SIEM Query:

source="web_logs" AND (uri_path="/?s=" OR uri_path LIKE "%/search/%") AND (query_string LIKE "%cats=%" OR query_string LIKE "%tags=%") AND (query_string LIKE "%SLEEP(%" OR query_string LIKE "%BENCHMARK(%" OR query_string LIKE "%WAITFOR%" OR query_string LIKE "%pg_sleep(%")

📊 Metadata

CVE ID: CVE-2025-4396

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-89

EPSS Score: 21.05% exploit probability (95.5th percentile)

Published: May 13, 2025

Last Updated: May 13, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-4396, you might also want to check these: