The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection through the 'form_data[s]' parameter. The vulnerability is caused by insufficient escaping of user input and the lack of prepared statements for the underlying SQL query. Unauthenticated attackers can supply crafted input to this parameter, allowing them to append arbitrary SQL commands to the existing query. This can lead to extraction of sensitive information from the database, such as user credentials, content, and other confidential data. The severity of the vulnerability is reflected in a CVSS score of 7.5. The EPSS score is less than 1%, indicating a low current exploit probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would target the WordPress site’s search interface using web requests to submit the malicious payload, exploiting the unauthenticated nature of the flaw.

The affected product is the WP Fast Total Search – The Power of Indexed Search plugin by epsiloncool. All releases up to and including version 1.80.280 are vulnerable; older versions earlier may also be impacted.

The CVSS base score of 7.5 classifies this as a high severity vulnerability. The low EPSS (<1%) suggests that, at present, exploitation is unlikely, and the lack of KEV listing further reduces the perceived threat. Nevertheless, because the flaw is unauthenticated, any attacker who can reach the search endpoint can exploit it to read data from the database. Successful exploitation requires only the ability to send HTTP requests to the plugin’s search page.