The vulnerability lies in the Relevanssi and Relevanssi Premium WordPress plugins' Admin Search AJAX handler, which accepts a URL‑encoded args parameter. The handler builds a WP_Query and forwards taxonomy query data to Relevanssi's internal builder. While the taxonomy input is sanitized as text, the resulting SQL fragment is inserted directly into a term‑taxonomy lookup query without proper parameterization. This oversight enables a contributor‑level user with the edit_posts capability to inject arbitrary SQL and perform a time‑based blind SQL injection against the WordPress database, potentially compromising data confidentiality or integrity.

This flaw affects the free Relevanssi plugin up to and including version 4.27.1 and the Relevanssi Premium plugin up to and including version 2.30.2. Both versions are maintained by the vendors Relevanssi and comesio and include the same vulnerable code path.

The CVSS base score of 6.5 signifies moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation as of this data. However, exploitation requires an authenticated user with edit_posts rights, limiting the attack surface to contributors or higher roles. The likely attack vector is an authenticated contributor sending a specially crafted Admin Search AJAX request and measuring response timing to infer database information. Successful exploitation would allow unauthorized data read or modification within the WordPress database.