What is the CVSS score of EUVD-2026-53118?

EUVD-2026-53118 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Ajax Load More are affected by EUVD-2026-53118?

The Ajax Load More plugin, installed on thousands of WordPress sites, contains a critical data extraction flaw that bypasses authentication controls.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-53118?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53118. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-53118?

Within 24 hours: identify all WordPress installations using Ajax Load More through WordPress admin dashboards or automated vulnerability scanning. Within 7 days: update all instances to version 8.0.1 or later, prioritizing production sites with user data or administrative accounts. Within 30 days: audit database access logs for suspicious SQL injection patterns on the vulnerable parameter and deploy Web Application Firewall rules to block common SQL injection attacks.

Ajax Load More EUVD-2026-53118

| CVE-2026-15360 CRITICAL

SQL Injection (CWE-89)

2026-08-05 WPScan

GHSA-4q9x-wqvr-prwf

WordPress Information Disclosure SQLi Ajax Load More Unknown

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote blind SQLi (AV:N/AC:L/PR:N/UI:N) gives high confidentiality via data exfiltration; description shows only read access, so I:N and A:N unlike the source's I:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:44 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

CRITICAL 9.1

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

Articles & Coverage 1

News Critical SQL Injection in WordPress Ajax Load More Plugin - CVE-2026-15360 Aug 06, 2026

AnalysisAI

SQL injection in the Ajax Load More WordPress plugin before 8.0.1 lets unauthenticated attackers inject into an unsanitised parameter used in a database query, enabling time-based blind extraction of sensitive data such as user credentials and secrets. Reported by WPScan with publicly available exploit detail and a vendor patch in 8.0.1; scored CVSS 9.1 with an unauthenticated network vector. EPSS is low (0.19%, 9th percentile), indicating limited observed exploitation despite the critical rating.

Technical ContextAI

Ajax Load More is a WordPress plugin that dynamically loads posts, comments, and other content via AJAX requests, meaning its endpoints are reachable by any visitor including unauthenticated ones. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a request parameter is concatenated into a SQL query without proper sanitisation or escaping (e.g. bypassing WordPress's $wpdb->prepare()/esc_sql() safeguards). The affected CPE is cpe:2.3:a:unknown:ajax_load_more, and because the injectable query returns no direct output, exploitation relies on time-based blind techniques (conditional SLEEP/BENCHMARK style delays) to infer data character by character.

RemediationAI

Vendor-released patch: update the Ajax Load More plugin to version 8.0.1 or later, which is the primary and complete fix. Until the update is applied, restrict or disable the plugin's AJAX endpoints and place the site behind a WAF with SQL-injection rules tuned to block time-based payloads (SLEEP/BENCHMARK and boolean conditionals) targeting the plugin's parameters - noting a WAF is a stopgap that can be bypassed and may block legitimate query strings. If the plugin is not essential, deactivate and remove it to eliminate the exposed endpoint entirely, at the cost of losing dynamic content-loading functionality. After patching, rotate any secrets or credentials that could have been exposed via the database, since blind SQLi read access may already have leaked data. Refer to the WPScan advisory (https://wpscan.com/vulnerability/0b5c1dd6-8bb9-45f7-8237-84a43ef53ec4/) for confirmation of the fixed version.