Relevanssi Premium A Better Search
Monthly
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.