Relevanssi – A Better Search (Pro) - SQLi (CVE-2025-4396)

CVE-2025-4396 is a vulnerability in the Relevanssi – A Better Search plugin for WordPress that allows unauthenticated attackers to perform time-based SQL injection via the cats and tags query parameters. This flaw, present in both free and premium versions up to 4.24.4 and 2.27.4 respectively, could enable attackers to extract sensitive information from the WordPress database. Exploiting this vulnerability could lead to significant data exposure and compromise of confidential site information.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-4396 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-4396 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-4396 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit this vulnerability by sending requests to WordPress sites with the Relevanssi plugin, injecting SQL payloads into the cats or tags query parameters (e.g., /?s=...&cats=1*sleep(5)) to perform time-based SQL injection and extract sensitive database information.