CVE-2026-15018 is a time-based SQL Injection vulnerability in the Database Collation Fix WordPress plugin, affecting all versions up to and including 1.2.10. The flaw is due to improper neutralization of special elements in the 'force-collation-algorithm' parameter, allowing unauthenticated attackers to append additional SQL queries. Successful exploitation depends on the presence of a trigger.txt file in the plugin directory, which is created by DesktopServer integration events. This vulnerability can be leveraged to extract sensitive information from the database without authentication.

An unauthenticated attacker can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive database information. The vulnerability does not allow modification or destruction of data (no integrity or availability impact), but confidentiality is impacted. Exploitation requires a specific file (trigger.txt) to be present, limiting the attack surface to environments using DesktopServer integration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should verify the presence of the trigger.txt file and consider removing or restricting access to it. Additionally, avoid using the affected plugin versions in environments where DesktopServer integration creates this file. Monitor vendor channels for updates or patches addressing this vulnerability.