---
id: CVE-2026-15018
title: >-
  The Database Collation Fix plugin for WordPress is vulnerable to time-based
  SQL Injection via the 'force-collation-algorithm' parameter in all versions up
  to, and including, 1.2.10 due to insufficient escaping on the user supplied
  parame…
summary: >-
  The Database Collation Fix plugin for WordPress is vulnerable to time-based
  SQL Injection via the 'force-collation-algorithm' parameter in all versions up
  to, and including, 1.2.10 due to insufficient escaping on the user supplied
  parame…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
published: '2026-08-01'
updated: '2026-08-01'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15018'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L131
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L148
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L251
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/database-collation-fix/trunk/databasecollationfix.php#L81
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3602218%40database-collation-fix&new=3602218%40database-collation-fix
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/874c1ba5-1bbd-43ac-bc5c-901638fa56ef?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.0042
epssPercentile: 0.33572
ingestedAt: '2026-08-02T05:17:47.934Z'
---

## Overview

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a trigger.txt file to be present in the plugin's directory (/wp-content/plugins/database-collation-fix/trigger.txt), a condition created by DesktopServer integration events such as site creation, copy, import, move, export, or deploy.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.