CVE-2026-15304
Deferred Deferred - Pending Action

SQL Injection in WordPress Plugin Organizer

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-15304
EUVD
EUVD-2026-49988

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
plugin_organizer plugin_organizer to 10.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Plugin Organizer plugin for WordPress has a SQL Injection vulnerability in versions up to 10.2.4. The issue occurs in the 'PO_plugin_path' parameter due to insufficient escaping. The perform_plugin_search() function uses esc_sql() which is then passed to preg_replace(), undoing the protection. Additionally, the AJAX handler lacks nonce verification and capability checks. Authenticated attackers with subscriber-level access can exploit this to inject SQL queries and extract sensitive database information.

Detection Guidance

This vulnerability can be detected by checking if the Plugin Organizer plugin for WordPress is installed and its version is up to 10.2.4. Look for suspicious SQL queries in logs or database activity involving the 'PO_plugin_path' parameter.

Impact Analysis

If you use the affected Plugin Organizer plugin, an attacker with subscriber-level access could extract sensitive data from your WordPress database. This includes user information, credentials, or other confidential data stored in the database. The vulnerability allows unauthorized access to information without requiring advanced privileges.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR and HIPAA requirements for data protection. GDPR mandates strict controls over personal data access, while HIPAA requires safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage due to non-compliance.

Mitigation Strategies
  • Update the Plugin Organizer plugin to the latest version if available.
  • Temporarily disable the plugin if an update is not available.
  • Review user roles and ensure only trusted users have subscriber-level access or higher.
  • Monitor database queries and server logs for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15304. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart