The WPdreams Ajax Search Lite plugin allows a blind SQL injection due to improper neutralization of special elements when building SQL commands. An attacker can supply crafted input to the plugin’s Ajax search endpoint, injecting arbitrary SQL that may read, modify, or delete database contents. This flaw can compromise sensitive data stored in the WordPress database and may enable further attacks if the database user has sufficient privileges.

WordPress sites using WPdreams Ajax Search Lite version 4.14.6 or earlier are affected. All installations of the plugin earlier than 4.14.7 are vulnerable.

The CVSS score of 9.3 indicates a critical severity. No EPSS score is available, but the lack of a KEV listing does not indicate the flaw is widely exploited yet. The likely attack vector is sending malicious query parameters to the Ajax search endpoint over HTTP. If successful, the attacker can perform blind SQL injection to exfiltrate data or alter site content, posing a serious confidentiality and integrity risk.