The Bravo Search & Replace plugin contains a SQL injection vulnerability (CWE‑89) that occurs due to inadequate neutralization of special characters. The flaw enables attackers to embed crafted input into database queries, allowing blind SQL injection that can read, modify, or delete data in the WordPress database. This could lead to confidential information leakage, data corruption, or full database compromise, affecting confidentiality and data integrity.

The issue affects the guelben Bravo Search & Replace plugin in versions up to and including 1.0. Any WordPress site that has installed this plugin is potentially vulnerable. All releases from the earliest available version through 1.0 are impacted.

The CVSS score of 7.6 signals high severity. Although the current EPSS score is below 1%, indicating low current exploitation probability, the vulnerability is not listed in CISA KEV. The attack vector likely involves submitting specially crafted input through the plugin’s interface, either from a site‑visible form or via an authenticated session. Due to the blind nature of the injection, successful exploitation would require an attacker to send multiple requests to infer database contents. Nevertheless, the potential for unauthorized data access and database compromise keeps the risk high.