The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• relevanssi relevanssibefore 1.14.6.1

Other highest-scoring records for the same primary product.

• CVE-2024-3214Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection
  39Monitor
• CVE-2024-1380Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export
  36Monitor
• CVE-2024-3213Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update
  32Monitor
• CVE-2024-7630Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure
  30Monitor
• CVE-2017-1000225Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anyt
  24Monitor
• CVE-2017-1000038WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affect
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.