{"id":"CVE-2026-15941","aliases":["EUVD-2026-53058","GHSA-q96m-48w3-jqmx"],"status":"published","title":"Relevanssi \u003c= 4.27.1 and Relevanssi Premium \u003c= 2.30.2 - Authenticated (Contributor+) SQL Injection","description":"The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00413,"percentile":0.35835,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-08-05T05:27:37Z","modified":"2026-08-12T21:00:37Z","products":[{"vendor":"comesio","product":"relevanssi – a better search"},{"vendor":"msaari","product":"relevanssi – a better search"},{"vendor":"relevanssi","product":"relevanssi premium – a better search"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f96b87a-1405-4cf6-b903-ad0c7c8e2826?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.1/lib/search-tax-query.php#L411"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.1/lib/admin-ajax.php#L195"},{"url":"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.1/lib/search.php#L969"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15941"},{"url":"https://github.com/advisories/GHSA-q96m-48w3-jqmx"}],"sources":{"cve":[{"id":"CVE-2026-15941","title":"Relevanssi \u003c= 4.27.1 and Relevanssi Premium \u003c= 2.30.2 - Authenticated (Contributor+) SQL Injection","description":"The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.","status":"published","published":"2026-08-05T05:27:37.308Z","modified":"2026-08-05T15:52:33.819Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-53058","description":"The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.","status":"published","published":"2026-08-05T05:27:37Z","modified":"2026-08-05T15:52:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:09.87889Z"}],"ghsa":[{"id":"GHSA-q96m-48w3-jqmx","title":"The plugin provides an Admin Search page that allows users with the `edit_posts` capability to...","description":"The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.","status":"published","published":"2026-08-05T06:30:31Z","modified":"2026-08-05T06:30:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:10:06.083807Z"}],"nvd":[{"id":"CVE-2026-15941","description":"The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.","status":"published","published":"2026-08-05T06:16:36.74Z","modified":"2026-08-12T21:00:37.147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:34.643497Z"}]}}