CVE-2026-15360 — Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

CVE-2026-15360

Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args PUBLISHED

Description (CNA)

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / Ajax Load More	affected 0 before 8.0.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0b5c1dd6-8bb9-45f7-8237-84a43ef53ec4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.