CVE-2026-59533 is an unauthenticated SQL Injection vulnerability (CWE-89) in Christoph Vielgrader's Relevanssi Light plugin, affecting versions up to 1.2.2. The vulnerability allows remote attackers to inject SQL commands without any authentication, resulting in a critical severity with a CVSS 3.1 base score of 9.3. The impact includes a complete confidentiality breach and a low availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data due to SQL Injection. The confidentiality impact is high, as attackers can potentially access or extract database contents. Integrity impact is not indicated, and availability impact is low but present. Since the vulnerability is unauthenticated, it can be exploited remotely without credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider implementing web application firewalls or other SQL Injection mitigations to reduce risk. Monitor official channels for updates from Christoph Vielgrader regarding fixes.