The JetSearch plugin for WordPress is susceptible to unauthenticated blind SQL injection, enabling potential unauthorized data exfiltration.

This is a blind SQL injection vulnerability (CWE-89) caused by improper neutralization of special elements in database queries. The CVSS vector confirms that the attack is unauthenticated (PR:N) and can be executed remotely over the network.

While blind SQL injection is typically slower to exploit than traditional SQL injection, it remains a critical risk as it allows an attacker to systematically reconstruct database contents. The potential for unauthorized data exfiltration poses a significant threat to user privacy and regulatory compliance, justifying the critical severity rating.

Immediate Action: Update the JetSearch plugin to version 3.5.10.1 or later to resolve the underlying sanitization issue.

Proactive Monitoring: Review web access logs for suspicious query parameters and monitor for increased database load, which may indicate automated data exfiltration attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common SQL injection payloads and limit the rate of requests to search-related endpoints.

Public Exploit Available: Unknown

Administrators must update JetSearch to version 3.5.10.1 immediately. Given the unauthenticated nature of this vulnerability, any delay in patching increases the window of opportunity for attackers to silently exfiltrate database contents.