Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-15360 describes an unauthenticated SQL Injection in the Ajax Load More WordPress plugin via the custom_args parameter. My analysis focused on identifying the specific code changes introduced in version 8.0.1 that address this vulnerability.
I started by fetching the WordPress.org plugin page for Ajax Load More, which provided a changelog. The changelog for version 8.0.1 explicitly mentioned 'Various security fixes' and 'Cast AJAX numeric params to int before arithmetic -> PR'. This indicated that the fix involved both general security improvements and specific handling of numeric AJAX parameters.
Next, I located the plugin's GitHub repository (ajaxloadmore/ajax-load-more) and used get_repo_tags to find the commit SHAs for versions 8.0.0 (vulnerable) and 8.0.1 (patched). I then used get_commit_infos to retrieve the detailed diff for the 8.0.1 release commit (c66c6236b38ed7bec8fdc4dd1fb89a4e0c92d131).
The most critical changes related to the SQL Injection were found in core/classes/class-alm-queryargs.php, specifically within the parse_custom_args function. Before the patch, this function directly processed values from the custom_args parameter without adequate sanitization. The fix introduced wp_parse_id_list() for parameters expecting ID lists (like author__in, post__in), which is a robust WordPress function for sanitizing such input into an array of positive integers, thereby preventing SQL injection. Additionally, the patch expanded the list of exlude_keys to prevent manipulation of other sensitive query parameters.
Further input sanitization improvements were observed in core/classes/class-alm-noscript.php, in the alm_get_noscript and set_offset functions. These functions were modified to use absint() to ensure that numeric parameters (like page numbers and offsets) were properly cast to integers. While these changes primarily address TypeError issues in PHP 8.x and general input validation, they contribute to the overall security posture by preventing unexpected behavior from malformed input, which can sometimes be a precursor to other vulnerabilities.
Therefore, ALM_Query_Args::parse_custom_args is the primary vulnerable function for the SQL injection, as it directly handled the custom_args parameter without proper sanitization. ALM_NOSCRIPT::alm_get_noscript and ALM_NOSCRIPT::set_offset are also identified as vulnerable due to insufficient input sanitization for numeric parameters, leading to potential type-related issues.
ALM_Query_Args::parse_custom_argscore/classes/class-alm-queryargs.php
ALM_NOSCRIPT::alm_get_noscriptcore/classes/class-alm-noscript.php
ALM_NOSCRIPT::set_offsetcore/classes/class-alm-noscript.php