External risk intelligence

Ajax Search Pro Blind SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-96331

The vulnerability affects a WordPress plugin designed to provide search functionality on websites. Such search components are commonly deployed as public-facing web features, making the vulnerable search interface reachable by internet users in standard website deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Ajax Search Pro plugin for WordPress. This issue, known as SQL Injection, could allow unauthorized access to or manipulation of underlying database information. The main concern is confirming if this specific plugin is in use and if it is exposed to potential exploitation.

Plugin allows database code injection.
Critical flaw impacts public-facing search.
Confirm plugin usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a website's search feature. This feature, which is accessible over the internet, processes search queries in a way that allows malicious SQL commands to be injected. If successful, this could lead to unauthorized access to sensitive data within the website's database, along with some disruption of service.

Publicly accessible search interface.
Injecting malicious SQL commands.
Sensitive data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to perform a blind SQL injection when supported by the advisory, potentially leading to the disclosure of sensitive data from the application's database. This could affect system data or user data depending on the database schema and application logic.

Sensitive database information may be exposed.
Via specially crafted requests to the search feature.
Data leakage and potential service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This SQL injection vulnerability in the Ajax Search Pro plugin likely impacts website owners and their associated development or infrastructure teams. The first practical step is for the website's technical owner to identify all instances of this plugin, confirm its accessibility from the internet, and assess its business criticality. Following this, a plan for remediation, which may involve vendor coordination or temporary risk reduction, should be developed based on the assessed risk.

Website owners or platform teams.
Confirm plugin accessibility and criticality.
Coordinate vendor fix or temporary mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ajax Search Pro plugin?

Ajax Search Pro is a WordPress plugin that adds advanced, real-time search functionality to websites. It is commonly used to enhance the user experience by providing live results as visitors type in a search bar, making it a standard feature on many sites.

What does SQL injection mean for CVE-2026-96331?

This CVE falls under the weakness class of Improper Neutralization of Special Elements used in an SQL Command (CWE-89). In plain English, it means the search feature fails to properly filter user input, allowing an attacker to insert their own database commands. This can trick the website's database into revealing sensitive information it should have kept private.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted search queries to the website. The flaw resides in how the plugin processes these queries. It is important to note that actions unrelated to the search input field, such as simply viewing a page or clicking non-search links, do not trigger the vulnerability.

Is my website at risk from this Ajax Search Pro flaw?

According to Halo Surface Signal, this vulnerability affects a plugin designed for public-facing search bars. Because these components are intended to be accessible to anyone browsing your site, they are inherently reachable from the internet. If your site uses an affected version, it is likely exposed.

What steps should I take to address CVE-2026-96331?

First, verify if your website is running an affected version of Ajax Search Pro. Once identified, evaluate the plugin's role on your site and check for vendor-provided updates or patches. If a fix is not immediately available, consider disabling the search functionality to mitigate the risk until you can secure the application.

References

patchstack.com/database/wordpress/plugin/ajax-search-pro/vulnerabili…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.