How I found SQL injection on 100,000 WordPress sites

jack@jacktaylor.tech (Jack Taylor) — Sun, 12 Apr 2026 00:47:49 +0900

I recently reported an unauthenticated SQL injection in Relevanssi, a WordPress search plugin that was active on more than 100,000 sites. There were two things that made this bug especially fun to work on: first, a type confusion issue where input that only looked like a numeric term ID could carry extra SQL with it, and second, an exploitation trick where one SQL injection payload was smuggled inside another in order to get around the limitations of the first query.

NahamCon 2022 CTF Write-up: Flaskmetal Alchemist

jack@jacktaylor.tech (Jack Taylor) — Sun, 01 May 2022 10:53:18 +0900

One of the most fun challenges in NahamCon 2022 was Flaskmetal Alchemist. This is a medium web challenge that involves an SQL injection that is relatively easy to spot, but tricky to exploit. I learned a few new things from this, so hopefully this write-up will provide inspiration to all you reading this. In this post I will walk you through my thought process and how I eventually exploited the vulnerability.

SQL Injection on Jack Taylor

How I found SQL injection on 100,000 WordPress sites

NahamCon 2022 CTF Write-up: Flaskmetal Alchemist