CVE-2026-15941: Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection
The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15941?
CVE-2026-15941 has a medium severity rating of 6.5.
How do I fix CVE-2026-15941?
To fix CVE-2026-15941, update Relevanssi to version 4.27.2 or later, or Relevanssi Premium to version 2.30.3 or later.
What type of vulnerability is CVE-2026-15941?
CVE-2026-15941 is classified as an Authenticated SQL Injection vulnerability.
Who is affected by CVE-2026-15941?
Users with the `edit_posts` capability in Relevanssi versions up to 4.27.1 and Relevanssi Premium versions up to 2.30.2 are affected.
What can an attacker do with CVE-2026-15941?
An attacker can exploit CVE-2026-15941 to execute arbitrary SQL queries on the database due to improper handling of user input.