CVE-2026-15018 is a time-based SQL Injection vulnerability in the Database Collation Fix WordPress plugin (up to version 1.2.10). The flaw is due to improper neutralization of special elements in the 'force-collation-algorithm' parameter, enabling unauthenticated attackers to inject additional SQL queries. Successful exploitation depends on the existence of a trigger.txt file in the plugin directory, which is created by DesktopServer integration events. This vulnerability can be leveraged to extract sensitive database information without authentication.

An attacker can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow modification or deletion of data (no integrity or availability impact reported), but confidentiality is impacted. Exploitation requires a specific file to be present, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the plugin directory and removing the trigger.txt file if not required may reduce exposure. Avoid using DesktopServer integration features that create the trigger.txt file if possible.