CVE-2026-15941 in Relevanssi Plugin
Summary
by MITRE • 08/05/2026
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists within a WordPress plugin that exposes an administrative search functionality accessible to users with the edit_posts capability. The flaw stems from improper input validation and sanitization practices within the AJAX handler responsible for processing search requests. When users submit search queries through the admin dashboard, the system accepts a URL-encoded args parameter that gets parsed into a WP_Query object before being processed by Relevanssi's taxonomy restriction system. The technical implementation demonstrates a classic SQL injection vector where user-controlled data flows directly into database queries without proper parameterization.
The vulnerability operates at the intersection of improper input handling and database query construction. While the taxonomy value is sanitized as text, this superficial sanitization fails to address the core issue of SQL query interpolation. The attacker with contributor-level privileges can manipulate the taxonomy restriction parameters through the admin search interface to inject malicious SQL payloads. The lack of parameterized queries means that user-supplied taxonomy values are directly concatenated into term taxonomy lookup queries, creating an exploitable injection point that bypasses standard WordPress security measures.
The operational impact of this vulnerability is significant as it allows authenticated attackers with minimal privileges to perform time-based blind SQL injection attacks against the WordPress database. This type of attack enables the attacker to extract information from the database through timing variations in query responses, potentially leading to full database compromise. The attack vector operates entirely within the WordPress admin interface, making detection more challenging as legitimate administrative traffic is involved. The vulnerability affects any WordPress installation using this specific plugin and can be exploited by users who have been granted edit_posts capabilities but not higher administrative privileges.
Mitigation strategies should focus on implementing proper parameterization of all database queries and eliminating direct string concatenation patterns that enable SQL injection. The plugin code must be updated to use prepared statements or parameterized queries when constructing taxonomy restriction clauses. Input validation should be strengthened beyond simple text sanitization to include comprehensive data type checking and length restrictions. Security measures should also include implementing proper access controls and monitoring for unusual administrative search activity. This vulnerability aligns with CWE-89 SQL Injection and ATT&CK technique T1213 Data from Information Repositories, demonstrating how seemingly minor input handling flaws can create significant security risks in content management systems. Organizations should immediately patch affected plugin versions and implement network-level monitoring to detect potential exploitation attempts through the admin search interface.