Relevanssi contributor taxonomy search permits blind SQL injection
Relevanssi Free through 4.27.1 and Relevanssi Premium through 2.30.2 allow users with edit_posts, including Contributors, to use the dashboard Admin Search. Its AJAX handler parses the URL-encoded args parameter into WP_Query data and passes attacker-controlled taxonomy values into the taxonomy restriction builder. Text sanitization leaves SQL metacharacters usable, and the value is interpolated into a term-taxonomy lookup without parameterization, permitting contributor-level time-based blind SQL injection. The CNA record does not disclose the AJAX action name.
- Component
- Relevanssi Premium – A Better Search, Relevanssi – A Better Search
- Plugin slug
relevanssi- Affected
- <= 2.30.2, <= 4.27.1
- Safe version
Free > 4.27.1, Premium > 2.30.2- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 15 known issues for this plugin.
Update, patch or deactivate.
Update Relevanssi Free to a release after 4.27.1 and Relevanssi Premium to a release after 2.30.2. The authoritative record establishes both affected boundaries but does not identify the first fixed releases. Restrict untrusted Contributor access until updated and review Admin Search requests for SQL-injection probes.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N