The Ajax Search Pro plugin contains a flaw that fails to properly neutralize special characters before incorporating user input into an SQL query, allowing an attacker to inject arbitrary SQL. This results in blind SQL injection, which can enable unauthorized data retrieval or modification. Because the attacker can obtain information without directly observing query results, the attack can remain covert while still compromising database confidentiality and integrity.

The vulnerable plugin is the wpdreams Ajax Search Pro WordPress extension released in versions up to 4.29.1. Any WordPress installation that has not upgraded beyond the 4.29.1 milestone is at risk, regardless of other security controls on the site.

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, but the lack of a low exploitation probability rating means the flaw remains a high-value target. The plugin is not listed in the CISA KEV catalog, yet its exposure through the search interface allows an attacker to trigger the injection with minimal effort; the specific authentication requirements are not specified in the description. An attacker can submit crafted search queries over the web to extract or alter data silently, potentially leading to credential theft or full database compromise.