CVE-2026-15360

Summary

The flaw is a time-based blind SQL injection vulnerability in the Ajax Load More WordPress plugin before version 8.0.1, allowing unauthenticated attackers to extract sensitive data from the database. This matters because it can lead to data breaches and compromise user information.

Exploitability

Exploitation requires access to the affected plugin's parameter input and knowledge of SQL injection techniques; no authentication is needed but technical expertise is required.

Blast radius

If exploited, attackers could extract sensitive data such as user credentials, personal information, or other confidential content stored in the database, significantly impacting site security and user trust.

Prioritized remediation

Update to Ajax Load More version 8.0.1 or later to address the vulnerability and ensure proper parameter sanitization and escaping.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.