CVE-2026-15360 Ajax Load More CVE debrief

Who should care

WordPress administrators and users of the Ajax Load More plugin, as well as security teams responsible for monitoring and protecting against SQL injection attacks, should be aware of this vulnerability and take necessary precautions to protect their systems. This includes verifying the version of the plugin, implementing additional security measures, and monitoring for potential attacks. The vulnerability's impact is limited to unauthenticated attackers, but it still poses a risk to sensitive data in the database.

Technical summary

The Ajax Load More WordPress plugin before 8.0.1 is vulnerable to time-based blind SQL injection due to improper sanitization and escaping of a parameter used in a SQL query. This allows unauthenticated attackers to extract sensitive data from the database. The vulnerability requires unauthenticated access and specific conditions to be met, making it a low-priority issue. However, WordPress administrators and users of the Ajax Load More plugin should still take necessary precautions to protect against potential attacks.

Defensive priority

Low priority, as the vulnerability requires unauthenticated access and specific conditions to be met.

Recommended defensive actions

• Verify the version of the Ajax Load More WordPress plugin and update to 8.0.1 or later if necessary.
• Implement additional security measures to monitor and restrict database access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence is limited, as the CVE record and NVD entry provide minimal information about the vulnerability. Further investigation and verification are necessary to fully understand the vulnerability's impact and affected scope. The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database. Defenders should verify the version of the plugin, review the official advisory, and implement additional security measures to monitor and restrict database access.

Official resources