CVE-2026-12741: Unauthenticated SQL Injection in WP Fast Total Search WordPress Plugin

A critical SQL injection vulnerability, tracked as CVE-2026-12741, has been identified in the "WP Fast Total Search - The Power of Indexed Search" WordPress plugin, impacting all versions up to and including 1.80.280. This flaw stems from inadequate sanitization and escaping of user-supplied input, specifically within the form_data[s] parameter, and insufficient preparation of existing SQL queries. Exploitation of this vulnerability allows unauthenticated attackers to append arbitrary SQL queries to legitimate database interactions. By leveraging this, attackers can bypass authentication, manipulate database content, or, most notably, extract sensitive information directly from the WordPress database, including user credentials, configuration settings, and other proprietary data. This poses a significant risk to the integrity and confidentiality of websites utilizing the affected plugin.

Attack Chain

1. An unauthenticated attacker identifies a WordPress website running the vulnerable "WP Fast Total Search" plugin.
2. The attacker constructs a specially crafted HTTP POST request targeting an endpoint that processes search queries from the plugin, typically wp-admin/admin-ajax.php.
3. The malicious request includes an SQL injection payload embedded within the form_data[s] parameter (e.g., form_data[s]=searchterm' UNION SELECT user_login,user_pass FROM wp_users--).
4. The vulnerable plugin receives the request and, due to insufficient input validation and improper SQL query construction, directly incorporates the attacker's payload into the backend database query.
5. The database management system executes the combined, malicious SQL query.
6. The database responds to the web server, including the results of the attacker's injected query, such as exfiltrated sensitive data like user credentials.
7. The web server returns the modified response to the attacker, who then parses the HTTP body to extract the sensitive information.

Impact

Successful exploitation of CVE-2026-12741 grants unauthenticated attackers the ability to extract sensitive information directly from the website's database. This includes, but is not limited to, administrator credentials, user data, plugin configurations, and other proprietary business information. Such data exfiltration can lead to complete website compromise, unauthorized access to user accounts, data breaches, and further malicious activities like defacement or malware injection. The impact on confidentiality and integrity is severe, potentially resulting in reputational damage, regulatory fines, and significant operational disruption for affected organizations.

Recommendation

• Patch CVE-2026-12741: Immediately update the "WP Fast Total Search - The Power of Indexed Search" WordPress plugin to a patched version beyond 1.80.280 to remediate CVE-2026-12741.
• Deploy the Sigma rules: Deploy the Detect CVE-2026-12741 Exploitation - WP Fast Total Search SQLi Attempt Sigma rule to your SIEM to identify and alert on attempted exploitation of CVE-2026-12741.
• Enable webserver logging: Ensure comprehensive webserver logging (e.g., Apache, Nginx access logs) is enabled to capture cs-method, cs-uri-stem, cs-uri-query, and sc-status for full visibility into HTTP requests.