CVE-2024-7573 is an argument injection vulnerability (CWE-88) in the Relevanssi Live Ajax Search plugin for WordPress, affecting all versions up to 2.4. The vulnerability arises from insufficient input validation of POST data in the search function, enabling unauthenticated attackers to manipulate WP_Query arguments. This can lead to unauthorized exposure of sensitive content like attachments or private posts. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can inject arbitrary arguments into WP_Query via the vulnerable search function, potentially exposing sensitive information such as attachments or private posts that should not be publicly accessible. There is no indication of integrity or availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the Relevanssi Live Ajax Search plugin's search functionality to unauthenticated users to reduce exposure.