PT-2026-67972

CVE-2026-15360

Published

2026-07-29

Updated

2026-10-04

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ajax Load More WordPress plugin versions prior to 8.0.1

Description Insufficient sanitization and escaping of a parameter used in a SQL query allows unauthenticated attackers to conduct time-based blind SQL injection. This technique involves sending queries that cause the database to pause for a specific amount of time before responding, enabling the attacker to extract sensitive data from the database.

Recommendations Update Ajax Load More WordPress plugin to version 8.0.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers