What is the CVSS score of CVE-2026-15941?

CVE-2026-15941 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Relevanssi CVE-2026-15941

EUVD-2026-53058 MEDIUM

SQL Injection (CWE-89)

2026-08-05 Wordfence

GHSA-q96m-48w3-jqmx

WordPress SQLi Relevanssi Wordpress Plugin Relevanssi Premium A Better Search Relevanssi A Better Search

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network AJAX endpoint requires only contributor authentication (PR:L); time-based blind injection yields full DB read (C:H) with no write or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 06:00 vuln.today

CVE Published

Aug 05, 2026 - 05:27 cve.org

MEDIUM 6.5

DescriptionCVE.org

The plugin provides an Admin Search page that allows users with the edit_posts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WP_Query, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.

AnalysisAI

SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the args parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.

Technical ContextAI

Two CPE entries are affected: cpe:2.3:a:relevanssi:relevanssi_premium_-_a_better_search (the commercial plugin) and cpe:2.3:a:comesio:relevanssi_-_a_better_search (the free WordPress.org plugin). The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements in SQL Commands). The AJAX handler in lib/admin-ajax.php (line 195 per the trac reference) accepts a URL-encoded args parameter, deserializes it into a WP_Query-compatible structure, and forwards taxonomy values into Relevanssi's taxonomy restriction builder at lib/search-tax-query.php (line 411). That builder performs a term taxonomy lookup by interpolating the unsanitized-for-SQL taxonomy string directly into a query, rather than using WordPress's $wpdb->prepare() or equivalent parameterized patterns. The third reference (lib/search.php:L969) indicates the injection point surfaces within the core search path. The attack manifests as time-based blind injection, meaning the attacker infers database contents from deliberate response delays rather than in-band data return.

RemediationAI

For the free Relevanssi plugin, upgrade to version 4.27.1 or later, confirmed patched per the WordPress plugin trac at https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.1/lib/search-tax-query.php#L411. The fix can be applied directly from the WordPress admin dashboard under Plugins > Update. For Relevanssi Premium users, consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4f96b87a-1405-4cf6-b903-ad0c7c8e2826 and the Relevanssi Premium vendor for the corresponding patched release, as the Premium fix version is not confirmed by the available trac references. As a compensating control prior to patching, restrict contributor-level registration on the WordPress site (Settings > General > uncheck 'Anyone can register', or set default role to Subscriber) - note this will prevent new contributor signups but does not revoke existing accounts. Additionally, a web application firewall rule blocking time-delay SQL keywords (SLEEP, BENCHMARK, WAITFOR) in AJAX requests to wp-admin/admin-ajax.php can reduce automated exploitation risk, though this is bypassable by determined attackers.