CVE-2026-15941

Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

2026-08-04 16:34
daroo

Strategic Overview

Status
Patched in 4.27.2
Affected Plugin
Relevanssi – A Better Search
Affected Version
<= 4.27.1
CVSS
6.5Medium
Weakness type
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE
CVE-2026-15941
View all Relevanssi – A Better Search vulnerabilities

At a glance

CVE-2026-15941 is a medium-severity Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Relevanssi WordPress plugin, affecting versions <= 4.27.1. It carries a CVSS score of 6.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires an authenticated account at Contributor level or above. The issue is fixed in version 4.27.2; sites on affected versions should update now. Disclosed August 2026, reported by daroo.

Vulnerability Overview

The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Reaching this weakness in Relevanssi <= 4.27.1 takes an account at Contributor level or above. SQL injection happens when request data is concatenated into a query instead of being bound as a parameter, letting an attacker change the structure of the statement rather than just its values.

A working injection can read any table the database user can see, which on a WordPress install means user records, password hashes and session or API secrets stored in options. For Relevanssi the fix is 4.27.2: builds <= 4.27.1 are affected, anything from 4.27.2 onward is not.

Remediation

Update to version 4.27.2, or a newer patched version

How WordSec helps

An attacker needs Contributor access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Relevanssi 4.27.2 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-15941https://www.wordfence.com/threat-intel/vulnerabilities/id/4f96b87a-1405-4cf6-b903-ad0c7c8e2826https://nvd.nist.gov/vuln/detail/CVE-2026-15941

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C