CVE Intelligence
Analysis AI-assisted

CVE-2026-96331: Ajax Search Pro WordPress Plugin - SQL Injection

A SQL injection vulnerability (CWE-89) in the Ajax Search Pro WordPress plugin allows Blind SQL Injection, according to the record. The record lists the affected range as up to and including 4.29.1 and a CVSS base score of 9.3 (critical). No fixed version and no CISA KEV listing appear in the record.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL injection flaw (CWE-89) in the Ajax Search Pro plugin for WordPress, published through Patchstack as CNA. The description states that the issue allows Blind SQL Injection.

Impact

  • Confirmed: the description states that the flaw allows Blind SQL Injection.
  • Confirmed: the record gives a CVSS base score of 9.3 (critical), with network attack vector, low complexity, no privileges required, no user interaction, high confidentiality impact, no integrity impact and low availability impact.
  • Inference: successful blind SQL injection could allow a remote party to read database content. The record does not describe which data would be exposed.

Affected products and versions

  • Product: Wpdreams Ajax Search Pro (ajax-search-pro).
  • The record states the affected range as up to and including 4.29.1, with the lower bound listed as n/a.
  • The record lists no fixed version. This does not mean no fix exists; whether a fix is available is unknown from the sources consulted.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS probability is 0.00243 (percentile 0.14591) with reference date 2026-10-23. The SSVC exploitation field is none and automatable is yes.

Remediation and mitigation

  • Identify all WordPress sites running Ajax Search Pro and confirm the installed version.
  • Check the Patchstack entry and the plugin vendor for a fixed release, and update as soon as a verified release is available.
  • While no fix is confirmed, reduce exposure where feasible by limiting database account privileges to the minimum required and restricting access to administrative functions.
  • Keep WordPress core and other plugins updated, and maintain tested backups.

Detection guidance

  • Review web server and application logs for unusual or repeated requests to the plugin search functionality, especially requests with abnormal parameter patterns or response timing anomalies.
  • Monitor database error logs and unexpected query volume from the web application.
  • Audit plugin file integrity and recently created or modified administrator accounts.

Limitations of the available information

  • The record does not list a fixed version, specific vulnerable endpoints or parameters, or a vendor advisory.
  • The record status is Deferred.
  • The lower bound of the affected range is n/a.
  • This analysis relies on the Patchstack entry and the NVD and CVE records referenced in the record.

Frequently asked questions

What is the vulnerability in CVE-2026-96331?

The record describes an SQL injection flaw (CWE-89) in the Ajax Search Pro WordPress plugin that allows Blind SQL Injection.

Which versions are affected?

The record lists the affected range as up to and including 4.29.1, with the lower bound given as n/a. No fixed version is listed.

Is this vulnerability known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.