CVE-2026-15304 Overview
CVE-2026-15304 is a SQL Injection vulnerability [CWE-89] affecting the Plugin Organizer plugin for WordPress in versions up to and including 10.2.4. The flaw resides in the perform_plugin_search() function, which handles the PO_plugin_path parameter without adequate escaping. The AJAX handler also lacks nonce verification and capability checks, compounding the exposure. Authenticated attackers with subscriber-level access or higher can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database.
Critical Impact
Authenticated attackers with only subscriber privileges can inject arbitrary SQL statements to exfiltrate confidential database contents, including user credentials and session data.
Affected Products
- WordPress Plugin Organizer plugin versions up to and including 10.2.4
- Fixed in Plugin Organizer version 10.2.5
- Any WordPress site with the vulnerable plugin installed and activated
Discovery Timeline
- 2026-07-28 - CVE-2026-15304 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15304
Vulnerability Analysis
The vulnerability exists in the Plugin Organizer plugin's perform_plugin_search() function inside PO_Ajax.class.php. User input from the PO_plugin_path parameter reaches a SQL query without sufficient sanitization. The developer applied esc_sql() to the input but then passed the escaped output as the replacement string to preg_replace(). PHP's preg_replace() interprets backslashes in the replacement string, collapsing the escape sequences produced by esc_sql() and neutralizing the quoting protection.
The AJAX endpoint further compounds the issue by omitting both nonce validation and capability checks. Any authenticated user, including the lowest-privilege subscriber role, can invoke the vulnerable handler. Successful exploitation yields read access to arbitrary tables in the underlying database.
Root Cause
The root cause is misuse of esc_sql() in combination with preg_replace(). WordPress's esc_sql() returns a string with backslash-escaped quotes suitable for direct concatenation into SQL. When that output becomes the replacement argument to preg_replace(), the regex engine treats backslashes as backreference markers and strips them. The resulting SQL fragment contains unescaped quotes, breaking out of the intended string literal.
Attack Vector
An attacker authenticates to the target WordPress site as any registered user, including a subscriber. The attacker then sends a crafted POST request to the plugin's AJAX endpoint with a malicious PO_plugin_path value containing SQL metacharacters and UNION-based payloads. The injected clauses are appended to the existing query, and responses reveal query results. See the Wordfence Vulnerability Report and the vulnerable code at PO_Ajax Class Line 969 for technical details.
Detection Methods for CVE-2026-15304
Indicators of Compromise
- POST requests to admin-ajax.php with the action parameter targeting Plugin Organizer AJAX handlers and unusual PO_plugin_path values
- Presence of SQL keywords such as UNION, SELECT, SLEEP, or -- in the PO_plugin_path request parameter
- Requests to the vulnerable endpoint originating from low-privilege authenticated sessions, especially subscriber accounts
- Anomalous spikes in database query duration correlated with plugin AJAX traffic
Detection Strategies
- Inspect web server access logs for admin-ajax.php requests containing encoded SQL syntax within the PO_plugin_path parameter
- Enable WordPress database query logging and flag queries containing unexpected UNION SELECT clauses referencing wp_users or wp_usermeta
- Deploy a Web Application Firewall (WAF) rule that blocks SQL metacharacters in the PO_plugin_path parameter
Monitoring Recommendations
- Monitor authentication events for newly created subscriber accounts followed by immediate AJAX activity
- Alert on outbound data transfers from the WordPress host that exceed baseline volumes after AJAX plugin requests
- Correlate WordPress audit logs with database access logs to identify unauthorized reads of sensitive tables
How to Mitigate CVE-2026-15304
Immediate Actions Required
- Update the Plugin Organizer plugin to version 10.2.5 or later on all WordPress sites
- Audit existing WordPress user accounts and remove unused subscriber-level or higher accounts
- Rotate credentials, secret keys, and API tokens stored in the database if exploitation is suspected
- Restrict user registration on public-facing WordPress sites where feasible
Patch Information
The vendor addressed the vulnerability in Plugin Organizer version 10.2.5. Review the fix in the WordPress Changeset Update 10.2.5. The patch replaces the unsafe preg_replace() construct with a parameter-safe query pattern and adds proper authorization checks to the AJAX handler.
Workarounds
- Deactivate and remove the Plugin Organizer plugin until it can be updated to version 10.2.5
- Deploy WAF rules to block requests containing SQL metacharacters in the PO_plugin_path parameter
- Disable open user registration and require administrator approval for new WordPress accounts
- Restrict access to wp-admin/admin-ajax.php by IP allowlist where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
