Junglewise Threat Intelligence

CVE-2026-15018: davejesch Database Collation Fix SQL injection in force-collation-algorithm

CVE-2026-15018 · Severity: medium · CVSS 5.3 · Published 2026-08-01

Executive brief

The Database Collation Fix plugin for WordPress, which helps manage database character sets, is vulnerable to a security flaw that could allow attackers to steal sensitive information. By exploiting a weakness in how the plugin handles specific settings, an attacker can run unauthorized database queries. However, this attack is difficult to perform because it requires a specific temporary file to be present on the server, typically created only during site maintenance tasks like migrations or exports.

Technical details

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL injection due to insufficient escaping of the 'force-collation-algorithm' parameter and a lack of SQL query preparation. An attacker can exploit this to append malicious SQL queries and extract sensitive data from the database. The vulnerability has a high complexity (AC:H) because exploitation requires a specific 'trigger.txt' file to exist in the plugin's directory. This file is typically only generated during DesktopServer integration events such as site creation, copying, importing, or deployment. The issue is addressed in versions following 1.2.10.

Affected products

  • davejesch Database Collation Fix <= 1.2.10

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References