Plugin Organizer
Plugin Organizer is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 28, 2026; the highest CVE/CNA score is 8.6.
plugin-organizerCVE-2026-15304: Plugin Organizer plugin search permits subscriber-level SQL injection
Plugin Organizer through 10.2.4 registers the authenticated AJAX action PO_perform_plugin_search without restricting it beyond a logged-in WordPress account. The perform_plugin_search() handler lacks nonce and capability checks and reads the attacker-controlled PO_plugin_path POST parameter. It places esc_sql() output into preg_replace() replacement strings used to construct several queries; replacement processing collapses backslash escapes before the resulting SQL reaches $wpdb->get_var() and $wpdb->get_results(). A Subscriber can therefore inject into the existing queries and extract sensitive database information. Version 10.2.5 requires the activate_plugins capability and a valid plugin nonce and replaces preg_replace() with str_replace().
| Safe version |
|
||
|---|---|---|---|
| Jul 28, 2026 |
CVE-2026-15304
Plugin Organizer plugin search permits subscriber-level SQL injection
Plugin Organizer through 10.2.4 registers the authenticated AJAX action PO_perform_plugin_search without restricting it beyond a logged-in WordPress account. The perform_plugin_search() handler lacks nonce and capability checks and reads the attacker-controlled PO_plugin_path POST parameter. It places esc_sql() output into preg_replace() replacement strings used to construct several queries; replacement processing collapses backslash escapes before the resulting SQL reaches $wpdb->get_var() and $wpdb->get_results(). A Subscriber can therefore inject into the existing queries and extract sensitive database information. Version 10.2.5 requires the activate_plugins capability and a valid plugin nonce and replaces preg_replace() with str_replace().
|
10.2.5 |
CVE6.5
NVDPending
|
| Dec 29, 2025 |
CVE-2025-13417
Plugin Organizer: SQL injection
Plugin Organizer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.6
NVDPending
|