What the vulnerability does
01Description
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
Explanation of Vulnerability in Simple Terms
02Summary
Relevanssi Premium contains a SQL injection vulnerability in its search functionality. An attacker with low-level site access can craft malicious search queries to read sensitive data from the site's database, including user information and configuration details. The vulnerability requires authentication but no user interaction. Update to a version newer than 2.30.2.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the site database via malicious search queries.
Potential impact on your site
04Site Impact
User data, posts, and configuration details stored in the database can be exposed to authenticated attackers.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account (subscriber or contributor level) on the site.
Key dates
06Disclosure timeline
August 5, 2026
CVE published
