CVE-2025-14719: 
WordPress vulnerability analysis and mitigation

CVE-2025-14719 is a SQL injection vulnerability in the Relevanssi and Relevanssi Premium WordPress plugins, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks. It affects Relevanssi (free) versions before 4.26.0 and Relevanssi Premium versions before 2.29.0. The vulnerability was publicly disclosed on December 17, 2025, and assigned a CVE on January 7, 2026. The CVSS v3.1 base score is 4.9 (Medium) per CISA-ADP, though WPScan rates it 6.8 (Medium) (WPScan, Feedly).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is insufficient sanitization and escaping of a user-supplied parameter before it is incorporated into a SQL query within the relevanssi_admin_search AJAX action handler. An authenticated contributor can craft a POST request to /wp-admin/admin-ajax.php with a malicious tax_query[0][taxonomy] parameter containing SQL payloads (e.g., time-based blind injection using SLEEP()), exploiting the lack of input validation in the plugin's admin search functionality (WPScan). Exploitation requires a valid WordPress account with at minimum the Contributor role and knowledge of a valid nonce value (searching_nonce) obtainable from the admin search page.

Successful exploitation allows an authenticated attacker to extract sensitive data from the WordPress database, including user credentials (hashed passwords), email addresses, private post content, and plugin/theme configuration data. The impact is primarily a high confidentiality breach with no direct integrity or availability impact, as reflected in the CVSS vector. While lateral movement is limited by the database scope, exposure of administrator credentials could lead to full site compromise (WPScan, Feedly).

A public proof-of-concept (PoC) is available via WPScan demonstrating a time-based blind SQL injection attack. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.021% (0.000210), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, Feedly).

1. Reconnaissance: Identify WordPress sites using the Relevanssi or Relevanssi Premium plugin in a vulnerable version (free < 4.26.0, Premium < 2.29.0) using tools like WPScan or by inspecting plugin directories.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least the Contributor role on the target site.
3. Retrieve Nonce: Navigate to https://example.com/wp-admin/?page=relevanssi_admin_search while authenticated and extract the searching_nonce value from the page source or JavaScript context.
4. Craft Malicious Request: Send a POST request to /wp-admin/admin-ajax.php with the following body, injecting a time-based blind SQL payload into the tax_query[0][taxonomy] parameter:

action=relevanssi_admin_search&args=tax_query%5B0%5D%5Boperator%5D=exists&tax_query%5B0%5D%5Btaxonomy%5D=') AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND ('x'='x&security=<nonce>

5. Confirm Injection: Observe a ~10-second response delay confirming the SQL injection is successful.
6. Extract Data: Use automated tools (e.g., sqlmap) with the confirmed injection point to enumerate and dump database tables, including WordPress user credentials and sensitive configuration data (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=relevanssi_admin_search and encoded SQL keywords (SLEEP, SELECT, UNION, AND) in the args parameter body.
• Logs: WordPress access logs showing repeated or slow-responding requests to admin-ajax.php from a single contributor-level user; abnormal response times (>5 seconds) for AJAX requests to the Relevanssi admin search endpoint.
• Application: Multiple admin search queries submitted in rapid succession by a low-privileged user account; queries containing URL-encoded special characters such as %27 (single quote) or %2527 in the tax_query parameter.

Update the Relevanssi free plugin to version 4.26.0 or later, and Relevanssi Premium to version 2.29.0 or later, which include proper sanitization and escaping of the affected parameter. No official configuration-based workaround has been published; upgrading is the only recommended remediation. Site administrators should also audit contributor-level accounts and restrict plugin access where possible (WPScan).

The vulnerability was reported by researcher Drew Webber (mcdruid) and verified by WPScan. Wordfence included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking channels.