CVE-2026-15304 is an SQL Injection vulnerability in the Plugin Organizer WordPress plugin. The issue arises because the 'PO_plugin_path' parameter is insufficiently escaped: esc_sql() output is used as a replacement string in preg_replace(), which collapses backslash escapes and negates the intended quoting protection. Additionally, the AJAX handler processing this parameter lacks nonce verification and capability checks, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary SQL commands. This can lead to unauthorized extraction of sensitive data from the database. No official patch or remediation information is provided in the available data.

An attacker with subscriber-level or higher authenticated access can exploit this vulnerability to perform SQL Injection attacks, enabling them to append additional SQL queries to existing ones. This can result in unauthorized disclosure of sensitive database information. The vulnerability does not affect system integrity or availability directly but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to limit access to authenticated users with subscriber-level or higher privileges. Monitor for updates from the vendor and apply patches promptly once released.