WP AutoSuggest 0.24 contains an unauthenticated SQL injection flaw that is triggered via the wpas_keys GET parameter in the autosuggest.php endpoint. By supplying crafted input, an attacker can execute arbitrary SQL against the WordPress database, enabling the extraction of posts, comments, users, or other sensitive data stored in WordPress tables. The weakness is classified as CWE‑89 and has a CVSS score of 8.8, indicating a high severity issue.

The vulnerability affects the WP AutoSuggest plugin version 0.24, developed by eliekhoury, when installed on WordPress sites. Sites that have not applied the latest patch or an update are potentially impacted, as the plugin’s default configuration allows direct access to the autosuggest.php endpoint.

The flaw carries a high CVSS rating, but no EPSS score is available and it is not listed in the CISA KEV catalog, suggesting limited widespread exploitation at present. Because the vulnerability is reached over HTTP/HTTPS and does not require authentication, it represents a network‑based attack vector that any external actor can use. The combination of high severity, unauthenticated access, and ease of exploitation makes the risk significant for affected WordPress installations.