The WordPress JobSearch plugin implements a data retrieval endpoint that incorporates user input directly into an SQL statement. An attacker can send specially crafted HTTP requests to exploit this flaw and inject arbitrary SQL code, with the likely attack vector being a crafted web request to the plugin's endpoint. This unauthenticated SQL Injection can allow the attacker to read, modify, or delete database rows, potentially exposing user credentials, personal information, and other sensitive site data.

Any WordPress site that hosts the JobSearch plugin version 3.2.9 or earlier, from vendor eyecix, is affected. Based on typical WordPress plugin behavior, these sites likely use the default WordPress database user and may not enforce authentication on the plugin's endpoints, but this is inferred rather than directly stated.

The CVSS score of 9.3 categorizes this vulnerability as critical. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. The flaw is unauthenticated and targets a publicly reachable endpoint, meaning an attacker can exploit it without any credentials. Because the injection directly manipulates the database, the risk of data exfiltration or complete site compromise is very high, based on the description, but this is inferred from the nature of the flaw. Timely remediation is essential to protect the integrity and confidentiality of site data.