CVE-2026-12741: WP Fast Total Search SQLi Vulnerability

CVE-2026-12741 Overview

CVE-2026-12741 is a SQL Injection vulnerability [CWE-89] in the WP Fast Total Search – The Power of Indexed Search plugin for WordPress. The flaw affects all versions up to and including 1.80.280. The plugin fails to properly escape the form_data[s] parameter and does not sufficiently prepare the underlying SQL query. Unauthenticated attackers can append additional SQL statements to the existing query and extract sensitive information from the WordPress database. The vulnerability is reachable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can exfiltrate database contents, including WordPress user records, password hashes, and configuration secrets, through a crafted form_data[s] search parameter.

Affected Products

WP Fast Total Search – The Power of Indexed Search plugin for WordPress (all versions ≤ 1.80.280)
WordPress sites with the Fulltext Search plugin (fulltext-search) installed and active
Any web-facing WordPress deployment exposing the plugin search endpoint

Discovery Timeline

2026-07-28 - CVE-2026-12741 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-12741

Vulnerability Analysis

The vulnerability is a generic SQL Injection in the plugin's search handling code path. User-controlled input arriving through the form_data[s] request parameter is concatenated into a database query without proper escaping or use of prepared statements. Because the query executes in the context of the WordPress database user, an attacker can piggyback additional SQL clauses onto the legitimate search query. This enables UNION-based or boolean/time-based extraction of arbitrary rows from the WordPress schema, including the wp_users and wp_options tables. The exploitable code paths are visible in fulltext-search.php (line 453) and includes/wpfts_search.php (line 825) as referenced in the WordPress plugin trac.

Root Cause

The root cause is insufficient input validation combined with missing query parameterization. The plugin accepts the form_data[s] value from HTTP requests and interpolates it directly into a SQL statement. WordPress provides $wpdb->prepare() for parameter binding, but the affected code path does not use it correctly for this parameter. As a result, quote characters and SQL metacharacters break out of the intended string context.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the plugin's search endpoint with a malicious payload embedded in the form_data[s] parameter. The payload closes the original string context and appends a secondary query, typically a UNION SELECT statement targeting wp_users or other sensitive tables. The database returns attacker-selected data in the search response. No credentials, session tokens, or user interaction are required. Confidentiality impact is high; the vector does not directly modify data or affect availability, per the published CVSS metrics.

No verified proof-of-concept code is publicly available. Technical details on the vulnerable functions are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-12741

Indicators of Compromise

HTTP requests containing form_data[s] with SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, INFORMATION_SCHEMA, or encoded variants (%27, %20UNION%20)
Unusually long or URL-encoded values in the s search parameter targeting /?s= or plugin search AJAX endpoints
Web server access logs showing repeated search requests from a single source with response size anomalies
Database errors referencing MySQL syntax written to PHP error logs or debug.log

Detection Strategies

Deploy WAF rules matching SQL injection patterns against the form_data[s] parameter and standard WordPress search endpoints
Inspect WordPress access.log for query strings containing SQL metacharacters routed to the fulltext-search plugin
Enable MySQL general query logging in test environments to identify unprepared queries originating from the plugin
Correlate outbound response size spikes on search endpoints with inbound requests containing suspicious s parameter payloads

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized log platform for query-parameter analysis
Alert on repeated 500 or 200 responses tied to search requests with SQL syntax tokens
Monitor for enumeration of wp_users, user_pass, and wp_options values in outbound response bodies
Track the presence and version of the fulltext-search plugin across WordPress inventory to identify unpatched hosts

How to Mitigate CVE-2026-12741

Immediate Actions Required

Deactivate the WP Fast Total Search (fulltext-search) plugin on all affected WordPress sites until a fixed release is installed
Apply virtual patching via WAF rules that block SQL metacharacters in the form_data[s] parameter
Rotate WordPress administrator passwords and any secrets stored in wp_options if exploitation is suspected
Audit wp_users for unauthorized accounts and review recent database access logs

Patch Information

At the time of publication, no fixed version beyond 1.80.280 is referenced in the NVD entry. Site operators should monitor the WordPress plugin repository and the Wordfence advisory for a vendor-supplied update. Until a patched release is available, removal or deactivation of the plugin is the recommended remediation.

Workarounds

Remove the plugin directory wp-content/plugins/fulltext-search/ from affected servers
Restrict access to WordPress search endpoints using IP allowlisting where feasible
Configure a WAF rule to reject any request where form_data[s] contains characters such as ', ", ;, --, or the string UNION (case-insensitive)
Enforce least-privilege on the WordPress database user to limit the scope of extractable data

bash

# Example ModSecurity rule to block SQLi in form_data[s]
SecRule ARGS:form_data[s] "@rx (?i)(union(\s|\+)+select|sleep\s*\(|benchmark\s*\(|information_schema|--|;)" \
    "id:1026127410,phase:2,deny,status:403,log,msg:'CVE-2026-12741 SQLi attempt in form_data[s]'"