The 404 Solution WordPress plugin allows an injected query through the filterText parameter used by the ajaxUpdatePaginationLinks action. Improper escaping and a bypass of the sanitization logic enable an attacker with administrator level access to append arbitrary SQL statements. The resulting time‑based blind injection can be used to extract sensitive data from the database, compromising confidentiality. This flaw is a classic SQL Injection weakness cataloged as CWE‑89.

Any WordPress site running the 404 Solution plugin version 3.1.0 or older. The vulnerability exists in all releases up to and including 3.1.0. The affected vendor is aaron13100:404 Solution. Administrators with access to the site’s back‑end or authorized users of the AJAX endpoint are the relevant user class.

The CVSS score of 4.9 indicates a moderate security impact. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with administrative privileges and to be able to send crafted requests to the ajaxUpdatePaginationLinks endpoint. The attacker can then inject and execute additional SQL statements, creating a potential data exfiltration vector.