The vulnerability is an improper neutralization of special elements used in an SQL command, identified as a SQL injection flaw in Crocoblock JetSearch. It allows blind SQL injection by allowing user input to be concatenated directly into queries without proper sanitization. The affected releases include all versions from the earliest available through 3.5.10. Successful exploitation could enable an attacker to read, modify, or delete data from the WordPress database, potentially compromising sensitive site information.

The affected product is the Crocoblock JetSearch plugin for WordPress, version 3.5.10 and all earlier releases. Organizations running a WordPress site with JetSearch up to and including 3.5.10 are vulnerable. No specific operating system or WordPress version is noted, so any environment that hosts the plugin is impacted.

With a CVSS score of 9.3, this flaw is considered critical. The EPSS score of less than 1% indicates that the likelihood of exploitation in the wild is currently believed to be very low, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote, via an HTTP request to the plugin's endpoint, but the exact conditions required to trigger the injection are not detailed in the source. The risk level remains high because a successful exploit would grant an attacker database-level access.