CVE-2026-15360 Overview
CVE-2026-15360 is an unauthenticated SQL injection vulnerability in the Ajax Load More WordPress plugin versions prior to 8.0.1. The plugin fails to sanitize and escape a user-controlled parameter before passing it into a SQL query. Attackers can exploit this weakness to perform time-based blind SQL injection against the underlying database. Successful exploitation allows extraction of sensitive data including user credentials, session tokens, and configuration secrets stored in the WordPress database. The flaw is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated attackers can extract arbitrary database contents from affected WordPress installations over the network without user interaction.
Affected Products
- Ajax Load More WordPress plugin versions prior to 8.0.1
- WordPress sites with the plugin installed and activated
- Any hosting environment exposing the vulnerable plugin endpoint to the internet
Discovery Timeline
- 2026-08-05 - CVE-2026-15360 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-15360
Vulnerability Analysis
The Ajax Load More plugin processes a request parameter and concatenates it into a SQL query without adequate sanitization or parameterization. Because the injection point does not return database output directly in the HTTP response, attackers rely on time-based blind SQL injection techniques. This method infers data by measuring query execution delays introduced through conditional SLEEP() or BENCHMARK() payloads.
The vulnerability requires no authentication and no user interaction. Any client capable of sending HTTP requests to the plugin endpoint can trigger the flaw. Successful exploitation exposes the full WordPress database, including the wp_users table containing password hashes and the wp_options table containing secrets and API keys.
Root Cause
The root cause is missing input validation and the absence of prepared statements when constructing the SQL query. WordPress provides the $wpdb->prepare() method to bind parameters safely, but the vulnerable code path bypasses this protection.
Attack Vector
The attack vector is network-based. An attacker sends a crafted HTTP request to the plugin's AJAX endpoint containing a malicious payload in the affected parameter. The payload injects boolean or time-delay SQL conditions, allowing character-by-character extraction of database contents. Automated tools such as sqlmap can systematically enumerate schemas, tables, and columns once the injection point is identified.
Refer to the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-15360
Indicators of Compromise
- HTTP requests to Ajax Load More endpoints containing SQL syntax such as SLEEP(, BENCHMARK(, UNION SELECT, or encoded variants
- Unusually long response times from admin-ajax.php or plugin-specific endpoints correlated with a single source IP
- Elevated request volume from a single IP address targeting the plugin action parameter
- Web server access logs showing repeated parameter fuzzing patterns against the plugin
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect query strings and POST bodies for SQL injection signatures
- Correlate slow database query logs with inbound HTTP requests to identify time-based blind injection attempts
- Monitor for anomalous outbound data volumes from the WordPress host that could indicate data exfiltration following successful extraction
Monitoring Recommendations
- Enable MySQL slow query logging and alert on queries exceeding baseline execution thresholds
- Ingest WordPress access logs into a centralized SIEM for pattern analysis and long-term retention
- Alert on repeated 200-response requests to Ajax Load More endpoints with abnormal parameter lengths or encoded payloads
How to Mitigate CVE-2026-15360
Immediate Actions Required
- Update the Ajax Load More WordPress plugin to version 8.0.1 or later on all affected sites
- Audit database logs and WordPress access logs for prior exploitation attempts dating back to plugin installation
- Rotate WordPress administrator passwords, API keys, and secrets stored in wp_options if exploitation is suspected
- Restrict administrative access to the WordPress dashboard using IP allowlisting where feasible
Patch Information
The vendor released version 8.0.1 of the Ajax Load More plugin, which introduces proper input sanitization and parameterized queries for the affected code path. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI using wp plugin update ajax-load-more.
Workarounds
- Deactivate the Ajax Load More plugin until the patch can be applied if immediate updating is not possible
- Deploy WAF rules blocking SQL injection payloads targeting the plugin's AJAX action parameters
- Restrict access to wp-admin/admin-ajax.php from untrusted networks using web server access controls
# Update the Ajax Load More plugin via WP-CLI
wp plugin update ajax-load-more --version=8.0.1
# Verify the installed version
wp plugin get ajax-load-more --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
