CVE-2026-15360

Summary

The flaw is a time-based blind SQL injection vulnerability in the Ajax Load More WordPress plugin before 8.0.1, allowing unauthenticated attackers to extract sensitive data from the database. This matters because it can lead to data breaches and loss of confidentiality.

Exploitability

Exploitation is moderately hard as it requires the attacker to craft a specific SQL injection payload, but preconditions include the plugin being active and the database being accessible via the web interface.

Blast radius

If exploited, the impact is high as it could lead to the exposure of sensitive data, potentially affecting all users of the WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 8.0.1 or later of the Ajax Load More plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.