Ajax Search Pro: Unauthenticated blind SQL injection

Summary

The WordPress plugin Ajax Search Pro by wpdreams in versions up to 4.29.1 contains a blind SQL injection flaw. An unauthenticated attacker can send crafted requests to the search function and read, modify or delete database contents, including user accounts and private data. No login or user interaction is required, so any internet-facing WordPress site running the plugin is reachable. Version 4.29.2 fixes the issue.

Affected

• Ajax Search Pro up to and including 4.29.1 (lower bound of the affected range not specified)

Fixed in

• Ajax Search Pro 4.29.2 (vendor changelog, released 2026-09-15)
• Later releases 4.29.3 to 4.29.5 are listed in the vendor changelog and should be preferred

Workaround

• Deactivate the plugin until it can be updated.
• Restrict access to the site with a web application firewall that filters SQL injection attempts. This is a stopgap, not a fix.

Exploitation

• Not known to be exploited. Ionix and Strix report no KEV listing.
• A Vulners aggregator entry lists a VulnCheck KEV record; this is unverified.
• No standalone public exploit identified; the search was limited.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS: 0.00243.

Our recommendation

• Update Ajax Search Pro to 4.29.2 or later, ideally the latest version, immediately. The plugin is sold as a premium item and may not update via WordPress.org, so check the vendor download.
• If patching is not possible, deactivate the plugin or apply WAF rules as a temporary measure.
• Check web server and database logs from before the update for unusual search parameters or database errors.
• If suspicious activity is found, review database accounts and reset credentials.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Ionix threat center CVE-2026-96331 www.ionix.io
• WPScan Ajax Search Pro wpscan.com
• Ajax Search Pro vendor changelog changelog.ajaxsearchpro.com
• Strix CVE-2026-96331 www.strix.ai
• CIRCL Vulners entry CVE-2026-96331 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:46.