# CVE-2025-4396: Relevanssi – A Better Search (Pro) - SQLi

> Live exploitation tracking for CVE-2025-4396 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-4396

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Relevanssi – A Better Search (Pro), Msaari Relevanssi – A Better Search
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.

## CrowdSec analysis

[CVE-2025-4396](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-4396) is a vulnerability in the Relevanssi – A Better Search plugin for WordPress that allows unauthenticated attackers to perform time-based SQL injection via the cats and tags query parameters. This flaw, present in both free and premium versions up to 4.24.4 and 2.27.4 respectively, could enable attackers to extract sensitive information from the WordPress database. Exploiting this vulnerability could lead to significant data exposure and compromise of confidential site information.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-4396 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-4396 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-4396 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit this vulnerability by sending requests to WordPress sites with the Relevanssi plugin, injecting SQL payloads into the `cats` or `tags` query parameters (e.g., `/?s=...&cats=1*sleep(5)`) to perform time-based SQL injection and extract sensitive database information.

## Timeline

- 2025-05-13: CVE Published. CVE-2025-4396 is published to NVD.
- 2026-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2025-4396 exploitation attempts against the CrowdSec Network.
- 2026-02-02: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-4396 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4396.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-4396) follows observed exploitation activity for CVE-2025-4396. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.