SQL Injection Vulnerability in Plugin Organizer for WordPress

CVE-2026-15304

What is CVE-2026-15304?

The Plugin Organizer plugin for WordPress is exposed to an SQL Injection vulnerability through the 'PO_plugin_path' parameter. This issue arises from inadequate escaping of user input in the perform_plugin_search() function. When the output of esc_sql() is used as a replacement string in preg_replace(), it results in the collapse of backslash escapes, undermining the intended quoting protection. Furthermore, the AJAX handler associated with this plugin fails to implement nonce verification and lacks proper capability checks. Consequently, authenticated attackers with subscriber-level access or higher can inject additional SQL queries into existing queries, potentially allowing unauthorized access to sensitive database information.

References