Critical SQL Injection Flaw Found in Ajax Search Pro WordPress Plugin

A critical security vulnerability has been identified in the Ajax Search Pro WordPress plugin, exposing sites to potential database manipulation through blind SQL injection. The National Vulnerability Database (NVD) has assigned the issue CVE-2026-96331 and rated it as critical, with a Common Vulnerability Scoring System (CVSS) score of 9.3.

The flaw stems from improper neutralization of special elements used in SQL commands, a weakness classified under CWE-89. According to the NVD record, this vulnerability allows attackers to perform blind SQL injection attacks. In such scenarios, an attacker can send specific SQL queries to the database and infer information based on the application's response or behavior, even if the data is not directly displayed. This technique can lead to unauthorized access to sensitive data, modification of database records, or other malicious activities depending on the attacker's goals and the database's configuration.

Context and Background

SQL injection remains one of the most dangerous and prevalent web application vulnerabilities. It occurs when an application fails to properly validate or sanitize user input before including it in an SQL query. In the case of Ajax Search Pro, the improper handling of input allows malicious code to be executed within the database context.

The NVD description specifies that the vulnerability affects the plugin's ability to neutralize special elements in SQL commands. This lack of neutralization creates an entry point for blind SQL injection, where the attacker may not see the direct results of their query but can deduce the contents of the database through true/false responses or time delays. The high CVSS score of 9.3 reflects the severity of the potential impact, indicating that a successful exploit could lead to significant compromise of the underlying system.

Who is Affected

This vulnerability impacts users of the wpdreams Ajax Search Pro plugin for WordPress. Specifically, the issue affects all versions of the plugin starting from the earliest available version up to and including version 4.29.1. Any WordPress site running Ajax Search Pro within this version range is potentially vulnerable to exploitation.

Site administrators and security professionals managing WordPress installations should verify the version of Ajax Search Pro currently installed on their platforms. If the plugin version is 4.29.1 or lower, the site is considered affected by CVE-2026-96331. The wide range of affected versions suggests that many installations may be at risk, particularly if automatic updates have not been enabled or if the plugin has not been updated recently.

What should you do?

Currently, no patch, fix, or update has been confirmed by the vendor to address CVE-2026-96331. Security teams should monitor official channels from wpdreams for the release of a secure version. In the interim, organizations should assess their exposure by identifying all instances of the affected plugin.