{"id":"CVE-2026-15360","published":"2026-08-05T07:16:35.123","lastModified":"2026-08-05T16:16:50.597","description":"The Ajax Load More  WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/0b5c1dd6-8bb9-45f7-8237-84a43ef53ec4/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a time-based blind SQL injection vulnerability in the Ajax Load More WordPress plugin before 8.0.1, allowing unauthenticated attackers to extract sensitive data from the database. This matters because it can lead to data breaches and loss of confidentiality.","exploitability":"Exploitation is moderately hard as it requires the attacker to craft a specific SQL injection payload, but preconditions include the plugin being active and the database being accessible via the web interface.","blast_radius":"If exploited, the impact is high as it could lead to the exposure of sensitive data, potentially affecting all users of the WordPress site.","remediation":"Upgrade to version 8.0.1 or later of the Ajax Load More plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","wordpress"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:10:50.284Z"}}