The vulnerability arises from the Dynific Addons for Elementor plugin’s inadequate escaping of the 'q' query parameter within the ae_preview_post() AJAX handler and its preview_post_filter() callback. The code concatenates the user supplied value into a single‑quoted SQL LIKE literal after calling $wpdb->esc_like(), which only escapes underscore, percent and backslash but not single quotes. Because WordPress’s magic quotes can strip the escaped backslash, an attacker can terminate the string and inject arbitrary SQL, enabling them to append additional queries to retrieve sensitive database information.

WordPress sites running the Dynific Addons for Elementor plugin, version 1.3 or earlier, are affected. The issue exists in all installations of these versions regardless of the site’s configuration.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated WordPress account with Subscriber level or higher privileges to access the AJAX endpoint. Successful exploitation allows the attacker to read data from the database but does not provide remote code execution.