The Advance Product Search plugin for WordPress includes an unauthenticated SQL injection flaw in versions 1.4.4 and earlier. An attacker can insert crafted input into the search feature, which is then embedded directly into a database query without proper sanitization. This vulnerability allows the attacker to read, modify, or delete data within the WordPress database, contingent on the privileges granted to the database user employed by the site.

WordPress sites that have the ThemeHunk Advance Product Search plugin installed at version 1.4.4 or older are affected. The flaw is triggered through the publicly accessible search functionality, so any visitor to the site can attempt an exploit without needing administrative credentials.

The CVSS score of 9.3 classifies the issue as critical. Because no authentication is required and the vulnerability is exposed through a public interface, attackers can exploit it manually or via automated scanning whenever the plugin and site are online. The EPSS score is not available, but the absence of access controls indicates that exploitation is feasible. The vulnerability is not listed in the CISA KEV catalog, yet the high severity warrants prompt action.