How I found SQL injection on 100,000 WordPress sites

jack@jacktaylor.tech (Jack Taylor) — Sun, 12 Apr 2026 00:47:49 +0900

I recently reported an unauthenticated SQL injection in Relevanssi, a WordPress search plugin that was active on more than 100,000 sites. There were two things that made this bug especially fun to work on: first, a type confusion issue where input that only looked like a numeric term ID could carry extra SQL with it, and second, an exploitation trick where one SQL injection payload was smuggled inside another in order to get around the limitations of the first query.

Relevanssi on Jack Taylor

How I found SQL injection on 100,000 WordPress sites