CVE-2026-59533 Overview
CVE-2026-59533 is an unauthenticated SQL injection vulnerability affecting the Relevanssi Light WordPress plugin in versions up to and including 1.2.2. The flaw allows remote attackers to inject arbitrary SQL statements through the plugin's search functionality without authentication. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Because the attack requires no privileges or user interaction, any WordPress site running a vulnerable version is exposed over the network.
Critical Impact
Unauthenticated attackers can inject SQL statements against the underlying WordPress database, enabling data exposure and integrity impact on affected sites.
Affected Products
- Relevanssi Light WordPress plugin versions <= 1.2.2
- WordPress sites with the vulnerable plugin installed and enabled
- Multi-site WordPress deployments using Relevanssi Light for search
Discovery Timeline
- 2026-07-27 - CVE-2026-59533 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-59533
Vulnerability Analysis
The vulnerability resides in the Relevanssi Light plugin, a lightweight WordPress search extension. Attacker-controlled input reaches a SQL query without proper sanitization or parameterization. Because the affected code path is reachable by anonymous visitors, exploitation requires only a network-accessible WordPress instance running the plugin.
The scope change reflected in the CVSS vector indicates that successful exploitation can affect resources beyond the vulnerable component itself, extending impact to the broader WordPress database. Confidentiality impact is high, allowing an attacker to read arbitrary rows including user records, session tokens, and configuration data. The EPSS probability at publication was 0.236% (percentile 14.787), reflecting low observed exploitation activity at disclosure but not diminishing the technical severity.
Root Cause
The root cause is improper neutralization of special elements within a SQL statement. User-supplied search parameters are concatenated into a query string rather than bound as parameters through the WordPress $wpdb->prepare() interface. This allows syntax-breaking characters and SQL keywords to alter query structure.
Attack Vector
An unauthenticated remote attacker crafts a malicious HTTP request against a search endpoint exposed by the vulnerable plugin. By embedding SQL syntax such as UNION SELECT clauses or boolean-based payloads into the search parameter, the attacker forces the database to return attacker-chosen data. Blind and time-based extraction techniques are viable when responses do not directly echo query results. See the Patchstack advisory for additional detail.
Detection Methods for CVE-2026-59533
Indicators of Compromise
- HTTP requests to WordPress search endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants in query parameters
- Repeated requests from the same source with incrementing payload lengths, consistent with automated SQLi tooling
- Anomalous wp_users or wp_options row reads recorded by database audit logs
- Outbound connections from the web server to attacker infrastructure following suspicious search requests
Detection Strategies
- Enable WordPress query logging and inspect queries generated by the Relevanssi Light plugin for concatenated user input
- Deploy web application firewall rules that block known SQL injection payload patterns targeting the s and plugin-specific search parameters
- Correlate HTTP access logs with database error rates to identify probing activity
Monitoring Recommendations
- Monitor for HTTP 500 responses and MySQL syntax errors returned to public search requests
- Alert on outbound data volume spikes from the WordPress host that could indicate bulk record extraction
- Track authentication events for administrative accounts created or modified shortly after suspicious search traffic
How to Mitigate CVE-2026-59533
Immediate Actions Required
- Identify all WordPress installations running Relevanssi Light and confirm the installed version through the plugin management interface
- Disable the Relevanssi Light plugin on any site running <= 1.2.2 until a fixed release is applied
- Review database audit logs and web access logs for evidence of SQL injection probing against search endpoints
- Rotate WordPress administrator credentials and secret keys if exploitation is suspected
Patch Information
Refer to the Patchstack advisory for Relevanssi Light for the fixed version and vendor guidance. Update to a release later than 1.2.2 as soon as it is available through the WordPress plugin repository.
Workarounds
- Remove or deactivate the Relevanssi Light plugin and revert to the default WordPress search until patched
- Apply a web application firewall ruleset that blocks SQL metacharacters in requests targeting the plugin's search parameters
- Restrict access to the WordPress site with IP allow-listing where feasible to reduce the anonymous attack surface
# Disable the vulnerable plugin from the command line using WP-CLI
wp plugin deactivate relevanssi-light
wp plugin status relevanssi-light
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
