A critical SQL injection vulnerability in the Christoph Vielgrader Relevanssi Light plugin allows unauthenticated attackers to execute arbitrary database queries.

The plugin fails to properly sanitize user-supplied input before incorporating it into SQL commands. This allows an unauthenticated attacker to inject malicious SQL syntax, leading to unauthorized database interaction.

The CVSS score of 9.3 highlights the severity of this issue, as it allows for unauthorized data access without requiring any user account or elevated permissions. A successful exploit could lead to the exposure of sensitive site information, user credentials, or administrative data, potentially resulting in full system compromise.

Immediate Action: Update the Relevanssi Light plugin to version 1.2.3 or later to secure the application against this vulnerability.

Proactive Monitoring: Monitor site traffic and application logs for suspicious activity targeting search parameters or plugin-specific endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious SQL injection payloads from incoming HTTP requests.

Public Exploit Available: No (exploit_available: false)

Due to the critical nature of this vulnerability, administrators should perform an immediate update to the latest available version of the Relevanssi Light plugin. Applying the patch is the only definitive way to mitigate the risk of unauthorized database manipulation.