CVE-2026-15018

Name of the Vulnerable Software and Affected Versions Database Collation Fix versions prior to 1.2.11

Description The Database Collation Fix plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the plugin fails to properly escape the force-collation-algorithm parameter and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this to append malicious SQL queries and extract sensitive information from the database. Successful exploitation requires a trigger.txt file to be present in the plugin directory (/wp-content/plugins/database-collation-fix/trigger.txt), which typically happens during DesktopServer integration events like site creation, copy, import, move, export, or deploy.

Recommendations Update the plugin to a version newer than 1.2.10. Avoid using the force-collation-algorithm parameter until the update is applied.