Relevanssi EUVD-2026-53058

Exploitation requires an active WordPress account with the edit_posts capability, which is the minimum capability for the Contributor role (WordPress's fourth lowest role). The Relevanssi or Relevanssi Premium plugin must be installed and active. No non-default configuration is required beyond plugin activation - the vulnerable Admin Search AJAX handler is registered automatically on plugin load. Exploitation is limited to time-based blind read operations against the WordPress database (no write or schema-modification capability per the C:H/I:N CVSS impact metrics). Limiting factors include: the attacker must hold or obtain a valid WordPress account with at least Contributor privileges; sites with closed registration or Subscriber-only default roles present a higher barrier; and time-based blind injection is slower and noisier than error-based or UNION-based methods, increasing detection opportunity for monitored environments.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the threat model: network-exploitable with no complexity, requiring only contributor-level authentication, yielding full database read access. The PR:L rating is the critical limiting signal - on sites where contributor registration is closed or tightly controlled, exploitation requires a prior account compromise. On sites with open registration or high contributor turnover, the effective barrier is very low. The impact is confidentiality-only (C:H, I:N, A:N), consistent with read-only blind SQL injection; the entire WordPress database including user credentials, private posts, and plugin data is readable. No EPSS score was provided in the input data; exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, suggesting exploitation remains targeted rather than mass-automated at the time of this analysis. There is no signal conflict between the CVSS vector and the description - both point to network-accessible authenticated exploitation with database read impact.

An attacker registers a free contributor account on a WordPress site running an unpatched Relevanssi version. They craft an HTTP POST to /wp-admin/admin-ajax.php with an action value targeting the Admin Search handler, embedding a malicious args parameter whose taxonomy value contains a time-delay SQL payload such as ' AND SLEEP(5)-- -. By measuring response latency across repeated requests with binary-search payloads, the attacker extracts the WordPress wp_users table - recovering email addresses and password hashes for all site accounts including administrators - without triggering any in-band error response.