CVE-2026-59533
Relevanssi Light, a WordPress search plugin, has a critical SQL injection flaw that lets attackers run arbitrary database commands without authentication. The vulnerability exists in all versions up to 1.2.2 and can be exploited remotely.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the Relevanssi Light plugin, version 1.2.2 or earlier.
Real-world impact
An attacker could read, modify, or delete data in the site’s database, potentially exposing sensitive user information or compromising the entire site.
Why this severity
The CVSS score of 9.3 reflects that the flaw is exploitable over the network (AV:N), requires no special access or user interaction (PR:N, UI:N), and can lead to complete compromise of confidentiality (C:H) and partial availability loss (A:L).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources