This vulnerability allows an attacker to perform a blind SQL injection by sending specially crafted input that is not properly escaped before being incorporated into an SQL statement. The flaw resides in the JetSearch plugin for WordPress, where user-supplied data is concatenated into a query without adequate sanitization. If successfully exploited, an attacker could read, modify, or delete data in the site's database, potentially compromising sensitive information hosted by the website.

The affected product is the Crocoblock JetSearch plugin for WordPress, version 3.5.10 and all earlier releases. Organizations running a WordPress site with JetSearch up to and including 3.5.10 are vulnerable. No specific operating system or WordPress version is noted, so any environment that hosts the plugin is impacted.

With a CVSS score of 9.3, this flaw is considered critical. The EPSS score of less than 1% indicates that the likelihood of exploitation in the wild is currently believed to be very low, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote, via an HTTP request to the plugin's endpoint, but the exact conditions required to trigger the injection are not detailed in the source. The risk level remains high because a successful exploit would grant an attacker database-level access.