CVE-2026-15941: Relevanssi Plugin SQLi Vulnerability

CVE-2026-15941 Overview

CVE-2026-15941 is a SQL injection vulnerability in the Relevanssi WordPress plugin through version 4.27.1. The plugin exposes an Admin Search page that accepts a URL-encoded args parameter via an AJAX handler. That parameter is parsed into a WP_Query and forwarded to Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but never parameterized before interpolation into a term taxonomy lookup query. An authenticated attacker with contributor-level access can inject SQL and run time-based blind queries against the WordPress database [CWE-89].

Critical Impact

Authenticated contributors can extract sensitive database contents, including user credentials and secrets stored in wp_options, through blind SQL injection.

Affected Products

• Relevanssi WordPress plugin (free edition) through version 4.27.1
• Installations exposing the Admin Search AJAX endpoint to users with edit_posts capability
• WordPress sites permitting contributor-level self-registration or open editorial roles

Discovery Timeline

• 2026-08-05 - CVE-2026-15941 published to NVD
• 2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15941

Vulnerability Analysis

The Relevanssi plugin registers an admin-facing AJAX handler in lib/admin-ajax.php that permits any user holding the edit_posts capability to submit search requests. The handler decodes a URL-encoded args payload and instantiates a WP_Query using attacker-supplied fields. When the query includes a tax_query clause, control passes to Relevanssi's taxonomy restriction builder in lib/search-tax-query.php. The builder applies text sanitization to the taxonomy identifier but concatenates the value directly into a SQL statement that resolves matching term_taxonomy_id rows. Because no prepared statement or $wpdb->prepare() placeholder is used, malicious payloads reach the database engine intact.

Root Cause

The root cause is unsafe string interpolation of user-controlled taxonomy input into a raw SQL query. Text sanitization removes obvious control characters but preserves punctuation and SQL keywords required for injection payloads. The design assumes taxonomy names originate from trusted registrations, yet the AJAX entry point accepts arbitrary values from any authenticated caller with edit_posts.

Attack Vector

An attacker authenticates as a contributor and issues a POST request to the Admin Search AJAX endpoint. The args parameter carries a crafted tax_query with a taxonomy value containing a time-delay payload such as a conditional SLEEP() expression. The database server evaluates the payload during term lookup, revealing information one bit at a time through response latency. Iterating the technique enumerates administrator password hashes, secret keys, and other sensitive rows.

The vulnerability is triggered through an authenticated AJAX POST to the Relevanssi Admin Search handler with a manipulated tax_query taxonomy field. No verified public proof-of-concept code has been released. See the Wordfence advisory and Relevanssi source references for technical details.

Detection Methods for CVE-2026-15941

Indicators of Compromise

• POST requests to admin-ajax.php with an action parameter targeting the Relevanssi admin search handler and a URL-encoded args body containing tax_query fields.
• Contributor or author accounts issuing repeated Admin Search AJAX calls that produce unusually long response times, consistent with time-based blind SQLi.
• Database slow-query logs referencing wp_term_taxonomy joins with unexpected SLEEP, BENCHMARK, or conditional expressions in the WHERE clause.

Detection Strategies

• Inspect PHP and web server logs for admin-ajax.php requests whose args parameter length or entropy exceeds normal editorial traffic.
• Alert on any authenticated session where AJAX response times exhibit statistically significant delays clustered around multiples of one second.
• Correlate WordPress user role assignments with unexpected access patterns to Relevanssi endpoints by low-privilege accounts.

Monitoring Recommendations

• Enable MySQL general or slow-query logging on WordPress databases and forward events to a central SIEM for pattern analysis.
• Monitor for creation of new contributor accounts followed by immediate use of admin AJAX endpoints.
• Track outbound connections and file writes originating from the web server process after suspicious search activity, in case the attacker chains to further actions.

How to Mitigate CVE-2026-15941

Immediate Actions Required

• Update the Relevanssi plugin to the patched release published after 4.27.1 as soon as it is available from the WordPress plugin repository.
• Audit WordPress user accounts and revoke edit_posts capability from any account that does not require editorial access.
• Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in wp_options if exploitation is suspected.

Patch Information

Relevanssi releases beyond 4.27.1 remediate the injection by parameterizing the taxonomy lookup. Review the WordPress Relevanssi Tax Query File, WordPress Relevanssi Ajax File, WordPress Relevanssi Search File, and the Wordfence Vulnerability Report for fix details.

Workarounds

• Deploy a web application firewall rule that blocks admin-ajax.php requests containing tax_query structures from non-administrator sessions.
• Temporarily disable the Relevanssi plugin on sites that allow untrusted contributor accounts until the patched version is installed.
• Restrict WordPress registration to trusted users and enforce strong authentication controls on all editorial accounts.

# Example WAF snippet: block tax_query in Relevanssi admin AJAX for low-privilege users
# ModSecurity rule (adjust IDs and phases for your deployment)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1015941,msg:'Relevanssi CVE-2026-15941 tax_query block'"
    SecRule ARGS:args "@rx tax_query" "t:urlDecodeUni"