SQL Injection Vulnerability in Ajax Load More Plugin by WordPress
CVE-2026-15360
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15360?
The Ajax Load More plugin for WordPress prior to version 8.0.1 suffers from a vulnerability where it inadequately sanitizes and escapes input parameters. This flaw can be exploited by attackers lacking authentication, enabling them to execute time-based blind SQL injection attacks. Such exploits could allow unauthorized access to sensitive data stored in the database, posing a serious risk to the security of affected WordPress installations.
Affected Version(s)
Ajax Load More 0 < 8.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.