CVE-2026-15941
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Relevanssi plugin provides an Admin Search page that allows users with the `edit_posts` capability to run searches. The AJAX handler parses a user-controlled `args` parameter and passes taxonomy data to the restriction builder, where the value is not parameterized before being interpolated into a SQL query. This allows an authenticated contributor-level attacker to perform time-based blind SQL injection.
Risk Assessment
An attacker with low privileges (contributor) can execute arbitrary SQL queries against the WordPress database, potentially leading to data exfiltration, content modification, or administrator account takeover.
Recommendation
Immediately update the Relevanssi plugin to the latest patched version. Until updated, restrict access to the admin search page or disable the plugin.
Other vulnerabilities in Relevanssi
See all- CVE-2026-116522High
The Relevanssi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.28.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires comment indexing and highlighting enabled, and the payload fires when a visitor reaches a singular page via a Relevanssi search-result permalink with the highlight query parameter.
- CVE-2026-114704High
The Relevanssi plugin for WordPress (versions up to 4.28.4) contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 4.28.4.
Original NVD description (English source)
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS