CVE-2026-15360
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Ajax Load More WordPress plugin before version 8.0.1 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
Risk Assessment
The risk involves potential unauthorized access to WordPress database data, including passwords, user data, and other confidential information, which could lead to site compromise.
Recommendation
Immediately update the Ajax Load More plugin to version 8.0.1 or later to remediate the SQL injection vulnerability.
Original NVD description (English source)
The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.