A critical SQL injection vulnerability in the WP Fast Total Search WordPress plugin allows unauthenticated attackers to access sensitive database information.

This is an improper neutralization of special elements used in an SQL command (CWE-89). The vulnerability allows an unauthenticated attacker to inject malicious SQL queries via the form_data[s] parameter, potentially leading to unauthorized data exfiltration.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive information stored within the WordPress database, such as user credentials, configuration details, or private content. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to data confidentiality and organizational compliance.

Immediate Action: Update the WP Fast Total Search plugin to a version beyond 1.80.280 as soon as the vendor provides a patch.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns targeted at search parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads directed at search input fields.

Public Exploit Available: Unknown

Organizations using this plugin should prioritize monitoring for suspicious activity until a patched version is available. Once a fix is released, administrators must apply the update immediately to prevent potential data breaches resulting from this SQL injection flaw.