{"id":"CVE-2026-96331","published":"2026-10-09T10:16:44.167","lastModified":"2026-10-09T18:17:16.250","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ajax-search-pro/vulnerability/wordpress-ajax-search-pro-plugin-4-29-1-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection attacks against the Ajax Search Pro plugin, potentially enabling unauthorized data access and manipulation. The flaw occurs when user input is not properly sanitized before being used in SQL queries.","exploitability":"Exploitation requires no authentication and can be achieved through crafted HTTP requests, making it highly exploitable with minimal preconditions.","blast_radius":"An attacker could extract sensitive database information including user credentials, configuration data, and potentially gain unauthorized access to the WordPress site's backend.","remediation":"Upgrade to version 4.29.2 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:51:53.768Z"}}