CraftCMS’s ElementSearchController::actionSearch() endpoint is missing a critical unset() protection that was added to a similar controller, allowing an authenticated control‑panel user to inject arbitrary SQL through criteria[where], criteria[orderBy], or other query properties. The vulnerability enables boolean‑based blind SQL injection that can retrieve the entire database, resulting in a full data compromise. This weakness reflects CWE-89 and carries a CVSS score of 8.7.

The issue affects CraftCMS distributions listed under the CPEs cpe:2.3:a:craftcms:craft_cms:5.0.0 and cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1, as well as other versions prior to the 5.9.9 release, which contains the proper patch. Any enabled element search endpoint that has not been updated to 5.9.9 or newer is vulnerable.

The CVSS score indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability requires authentication to the CraftCMS control panel but does not require administrative privileges, making the attack vector accessible to a wide range of users. Although the exploitation complexity is moderate, the potential impact on data confidentiality and integrity is significant. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been widely exploited in the wild.