External risk intelligence

Relevanssi Light Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-59533

The vulnerability affects a WordPress plugin, which is typically deployed as part of public-facing web applications. Because these plugins are used to extend functionality for sites accessible over the internet, they are frequently reachable by remote, unauthenticated users in common deployment scenarios.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the Relevanssi Light plugin, affecting systems that utilize this software. The issue, an unauthenticated SQL injection, means unauthorized access could be gained without needing any credentials, potentially impacting the integrity of data. Given the nature of this vulnerability, it's important to confirm if this specific plugin is in use within our environment.

Unauthenticated access via SQL injection.
Critical flaw impacts data integrity.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a website using the affected plugin. This could lead to unauthorized access to sensitive database information.

No authentication required.
Inject malicious SQL queries.
Expose sensitive data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject SQL commands into the Relevanssi Light plugin when it is supported by the advisory. This could lead to unauthorized access or modification of data stored within the application's database.

Database data could be exposed.
Via unauthenticated SQL injection.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical unauthenticated SQL injection vulnerability in Relevanssi Light affects WordPress plugins, likely managed by application owners or platform teams. The first practical step is to identify all instances of the affected plugin, assess their internet reachability and business criticality, and then confirm the accountable owner for remediation planning.

Application owners should manage the issue.
Verify plugin reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Relevanssi Light?

Relevanssi Light is a WordPress plugin designed to improve search functionality on websites. It acts as an extension to the core WordPress search system, helping site visitors find content more efficiently. Like other plugins in this ecosystem, it is installed directly into the WordPress directory to manage how queries are processed and returned to the end user.

What is the SQL injection weakness in CVE-2026-59533?

This vulnerability, classified as CWE-89, occurs when software fails to properly sanitize user-provided input before using it in database queries. Because the input is not cleaned, an attacker can supply malicious SQL code that the database executes as if it were a legitimate command. For this CVE, it means an unauthenticated party can manipulate the plugin's search operations to access or potentially modify database contents.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted web requests to the site hosting the vulnerable plugin. Because the vulnerability does not require any credentials, simply accessing the site and providing the malicious input is sufficient. Note that the bug is triggered through these specific network-based requests; administrative actions or user logins are not required for the exploit to function.

Do I need to worry if my site uses Relevanssi Light?

According to Halo Surface Signal, you should prioritize this if your plugin instance is accessible via the internet. Because Relevanssi Light is typically used in public-facing WordPress environments, it is often reachable by remote, unauthenticated users. If your site is internet-facing, the plugin is likely exposed to these network-based requests, making it a higher priority for review.

What is the first step to address CVE-2026-59533?

Start by identifying every WordPress installation within your environment that has this plugin active. Once identified, verify if those specific sites are reachable from the internet and evaluate their business importance. After gathering this inventory, locate the accountable owner for each site to ensure they are aware of the risk and can coordinate the necessary remediation steps.

References

patchstack.com/database/wordpress/plugin/relevanssi-light/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.