CVE-2026-15281

This is a second-order SQL injection vulnerability in a WordPress plugin where the attacker supplies a malicious payload during an AJAX save operation, which gets stored in the database, then later retrieved and concatenated directly into a SQL query when the plugin filters posts. The critical flaw is that the plugin's architecture treats data retrieved from its own database as inherently safe for SQL use — a fundamental misapprehension where 'data we stored ourselves' gets mentally filed under 'trusted' despite the database being nothing more than a persistence layer with no semantic understanding of what the data represents. The specific mechanism: the saveAjaxAttachmentData() function receives an objectId parameter and stores it without sanitization. Later, addQueryExpendedPostFilter() retrieves this value and uses implode() to concatenate it directly into a NOT IN() clause. This pattern — array key extraction through implode() into SQL — is a known anti-pattern that keeps reproducing across PHP applications despite decades of documented awareness. What makes this worse than a typical SQL injection: the exploitability at subscriber level means any logged-in user on a WordPress site running this plugin can inject the payload. The malicious data sits dormant in the database until triggered, which means passive scanning may miss it and the payload propagates into backups and staging environments before anyone notices. To verify if you're exposed, audit any code path that retrieves values from custom database tables and passes them into SQL queries without parameterization — particularly in filter or query hooks. The fix requires treating all retrieved data as untrusted input regardless of its provenance. Consider implementing taint tracking that persists provenance metadata through database round-trips so that retrieved values retain their 'untrusted' classification even after storage. This is not a one-off developer mistake — it's a structural failure that emerges from treating the storage layer as a trust boundary when it's merely a persistence mechanism.

Reviewed through automated stages and approved by a human before publication.