EUVD-2026-95610
GHSA-x2jq-5mqf-7hv6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin AJAX search endpoint
-
DeliveryInject SQL into search parameter
-
ExploitTrigger blind boolean/time-based query
-
ExecutionEnumerate database contents
-
ImpactExfiltrate credentials and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a WordPress site running the Ajax Search Pro (wpdreams) plugin at version 4.29.1 or earlier. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and requires no user interaction, consistent with the plugin's search functionality being exposed via a public front-end AJAX endpoint. The limiting factors are deployment-specific: the site must actually have a vulnerable Ajax Search Pro instance reachable, and because the injection is BLIND, successful data extraction requires many iterative automated requests (inference-based) rather than a single direct query, which raises exploitation effort and may be detectable in request logs/WAFs. |
| Impact | This is a genuinely high-priority flaw by its technical profile: the provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a network-reachable, low-complexity, unauthenticated (PR:N) blind SQL injection in a WordPress plugin, and CWE-89 blind SQLi reliably yields full database read access (wp_users hashes, secret keys, PII). However, several corroborating exploitation signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no POC/exploit reference provided, so real-world exploitation volume cannot be quantified from this data. The only source is a single Patchstack advisory, which is a credible vulnerability-intelligence vendor but does not by itself confirm active exploitation. One internal inconsistency to verify: the vector asserts S:C (scope change) and A:L for what is described purely as blind SQL injection - SQLi is typically confidentiality-focused with S:U, so the scope/availability metrics appear inflated and should be confirmed with the vendor/Patchstack. Net: treat as a serious patch-soon issue for any site running Ajax Search Pro ≤4.29.1, but note that absent EPSS/KEV/POC data the breadth of in-the-wild exploitation is unknown and likely not yet mass-automated. |
| Exploit ScenarioDerived | A remote attacker sends a crafted request to the plugin's AJAX search endpoint containing a malicious SQL payload in a search-related parameter, and uses boolean/time-based blind techniques to infer data character-by-character from the WordPress database. Over repeated automated requests this extracts administrator password hashes and secret keys. No public exploit code was identified at time of analysis, and per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.
RemediationAI
No vendor-released patch version is identified in the available data, so the first step is to check the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ajax-search-pro/vulnerability/wordpress-ajax-search-pro-plugin-4-29-1-sql-injection-vulnerability?_s_id=cve) for a corrected Ajax Search Pro release and upgrade immediately when one is published, applying WordPress plugin updates through the dashboard or WP-CLI with a tested backup in place. If no fix is yet available, the pragmatic mitigation is to deactivate the Ajax Search Pro plugin until a patched build ships; the trade-off is loss of the site's enhanced search functionality, which may be acceptable for high-value or high-traffic sites and can be partially offset by falling back to WordPress core search. Where deactivation is not feasible, restrict exposure by placing a WAF or reverse proxy in front of the site with virtual patching targeted at the plugin's AJAX search endpoints and SQL metacharacters in search parameters - noting that generic SQLi rules risk false positives on legitimate searches and require tuning - and rate-limit or challenge repeated automated requests to that endpoint, recognizing that blind inference attacks generate distinctive high-volume request patterns in access logs. Because the flaw is unauthenticated, do not rely on login hardening or role restrictions as a control; instead prioritize reducing the plugin's reachability, rotating WordPress salts and forcing a credential reset if compromise is suspected, and monitoring database and web logs for anomalous sequential query behavior.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection in a WordPress plugin rather than in WordPress core. Ajax Search Pro (wpdreams) implements a front-end search feature that forwards user-supplied query parameters to the WordPress database through AJAX requests handled by the plugin; because the query is constructed without proper neutralization or parameterization of the user-controlled search term, an attacker can append SQL syntax that alters the executed statement. The CPE entry cpe:2.3:a:wpdreams:ajax_search_pro:*:*:*:*:*:*:*:* confirms every version of the plugin is treated as in scope by the reporting source, with 4.29.1 stated as the version through which the issue applies. The injection is BLIND, meaning the application does not return query results or database errors directly to the attacker, so data must be extracted through boolean or time-based inference over many crafted requests - this is why the vector carries C:H for confidentiality benefit with no direct integrity or availability impact in the assessed version. The underlying exposure surface is the plugin's public search endpoint, which by design is reachable without authentication, consistent with the PR:N/UI:N portion of the vector.
Know when Ajax Search Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable unauthenticated blind SQLi gives AV:N/AC:L/PR:N/UI:N and C:H; blind read-only injection has no integrity/availability impact and does not cross a security boundary, so I:N/A:N and S:U rather than the input's S:C/A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.
Executive ViewAI
A critical, unauthenticated SQL injection flaw in the wpdreams Ajax Search Pro WordPress plugin (all versions through 4.29.1) exposes every internet-facing site running it to remote database extraction without any credentials or user interaction. Because no vendor patch is currently available, any such site remains directly attackable until mitigations are applied, and a successful exploit could expose user password hashes, authentication keys, and customer PII - triggering breach notification, regulatory, and reputational consequences. Leadership should treat this as an active exposure-management event requiring immediate inventory and containment of affected WordPress properties.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or uninstall the wpdreams Ajax Search Pro plugin on all internet-exposed sites; block or restrict external requests to the plugin's Ajax search endpoint via WAF, reverse proxy, or web server rules; deploy virtual patching signatures targeting blind SQL injection in the plugin's search parameters; restrict /wp-admin/admin-ajax.php access to trusted sources where operationally feasible; rotate WordPress salts, database credentials, and any secrets or API keys recoverable from affected databases; and monitor logs for high-volume, iterative Ajax search requests indicative of bit-by-bit extraction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB