The Ajax Load More WordPress plugin before version 8.0.1 contains a flaw that fails to sanitize the custom_args parameter before using it in an SQL query, enabling attackers to perform time‑based blind SQL injection. This vulnerability permits extraction of arbitrary database contents, such as usernames, passwords, and other sensitive information, constituting a serious confidentiality breach and aligning with CWE‑89.

WordPress sites that run Ajax Load More plugin version 8.0.1 or earlier are affected. The flaw exists whenever the plugin’s custom_args endpoint is accessible to unauthenticated users.

The vulnerability is unauthenticated and requires only a crafted HTTP request to the plugin’s endpoint, allowing exploitation from any network location that can reach the site. The CVSS score of 9.1 indicates critical severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Given its ease of exploitation and the potentially devastating impact on data confidentiality, the overall risk is high.