CVE-2026-15304

Name of the Vulnerable Software and Affected Versions Plugin Organizer versions prior to 10.2.5

Description Authenticated attackers with subscriber-level access and above can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs because the perform plugin search() function fails to properly escape the PO plugin path parameter. Specifically, the output of esc sql() is passed as a replacement string to preg replace(), which removes backslash escapes and bypasses quoting protections. Furthermore, the AJAX handler does not implement nonce verification or capability checks.

Recommendations Update to a version newer than 10.2.4.