Executive Summary

A critical vulnerability (CVE-2026-59533, CVSS 9.3) was discovered in the Relevanssi Light plugin (versions <= 1.2.2) for WordPress, allowing unauthenticated SQL injection. This vulnerability is not currently being exploited, but it poses a significant risk to WordPress sites using the affected plugin versions. Immediate action is required to update to a patched version.

Technical Analysis

CVE-2026-59533 is an unauthenticated SQL injection vulnerability in the Relevanssi Light plugin for WordPress. The vulnerability class is SQL Injection, specifically CWE-89. The attack vector is network-based (AV:N), with low attack complexity (AC:L) and no privileges required (PR:N). The vulnerability affects versions of the plugin up to and including 1.2.2.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted SQL query to the vulnerable plugin. The attacker would not need any privileges or authentication to trigger the vulnerability. Upon successful exploitation, the attacker could potentially extract or modify sensitive data in the database, leading to confidentiality impacts. For example, an attacker might send a malicious request to the plugin's search functionality, injecting SQL code that allows them to access unauthorized data.

Impact Assessment

The vulnerability affects Relevanssi Light plugin versions up to and including 1.2.2. The CVSS score of 9.3 indicates a critical severity level, with high impacts on confidentiality and low impacts on availability. The scope of the vulnerability is changed (S:C), indicating that the vulnerability can affect other components beyond the initial target.

Recommended Actions

To mitigate this vulnerability, it is highly recommended to update the Relevanssi Light plugin to version 1.2.3 or later. Additionally, users should ensure that their WordPress installation and all plugins are up-to-date. Monitoring for suspicious database queries or unusual activity on the WordPress site can help detect potential exploitation attempts.

Sources