The flaw is an unauthenticated SQL injection that occurs in the front‑end search functionality of Craft CMS when the attribute parameter is concatenated directly into a query; because the database driver uses emulated prepared statements, stacked queries are executed, enabling an attacker to read and write application data. The attacker can set the admin flag on user ID 1 or overwrite any account’s password hash, effectively granting full administrative control and bypassing authentication.

The vulnerability is present in Craft CMS releases earlier than 4.18.9 for the 4.x branch and 5.11.2 for the 5.x branch, regardless of operating system. It only affects sites that use a MySQL or MariaDB backend and require that the craft.search action be accessible from the web; any public site using this search component is potentially vulnerable.

The CVSS base score of 9.3 reflects a high‑impact, high‑confidentiality, integrity, and availability risk. EPSS data are not available and the vulnerability is not listed in CISA’s KEV catalog, yet the exposed unauthenticated write primitive combined with lack of input filtering makes exploitation highly likely once a front‑end request can be crafted. Attackers can submit a malicious query string to the search endpoint and gain administrator privileges. Based on the description, the likely attack vector is a public HTTP request to that component.