What is the CVSS score of CVE-2026-15018?

CVE-2026-15018 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Database Collation Fix CVE-2026-15018

EUVD-2026-51754 MEDIUM

SQL Injection (CWE-89)

2026-08-01 Wordfence

GHSA-jfr9-hqmg-pcc8

WordPress SQLi Wordpress Plugin Database Collation Fix

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable via HTTP with no auth per description (overriding PR:L in provided vector); AC:H retained for mandatory trigger.txt precondition; confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 09:01 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy.

AnalysisAI

Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:davejesch:database_collation_fix:*:*:*:*:*:*:*:*) processes user-supplied input via the 'force-collation-algorithm' HTTP parameter without proper escaping or parameterized query construction, violating CWE-89 (Improper Neutralization of Special Elements in SQL Commands). The vulnerability is a time-based blind variant, meaning the attacker cannot read query output directly but instead infers database content by measuring server response delays induced by injected SQL timing functions (e.g., SLEEP()). Vulnerable code paths are identifiable in databasecollationfix.php at lines 81, 131, 148, and 251 per the WordPress plugin trac browser. The plugin integrates with DesktopServer - a local WordPress development tool - and the trigger.txt file serves as an activation flag for certain plugin behaviors; its presence is a precondition for the vulnerable code path to be reachable.

RemediationAI

An upstream code change has been committed per the WordPress plugin trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3602218%40database-collation-fix&new=3602218%40database-collation-fix), however a specific patched release version is not independently confirmed from the available data - administrators should check the plugin's WordPress.org page and the Wordfence advisory for a confirmed fixed version before updating. As an immediate and highly effective workaround, delete the trigger.txt file at /wp-content/plugins/database-collation-fix/trigger.txt if DesktopServer integration is not actively in use; this eliminates the exploitation precondition entirely with no functional trade-off for standard WordPress operation. Additionally, configure web server permissions to prevent public HTTP access to the plugin directory, and consider restricting filesystem write access to the plugin folder to prevent DesktopServer from regenerating the trigger file on future events. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/874c1ba5-1bbd-43ac-bc5c-901638fa56ef for confirmed patch version information.