CVE-2025-14477 is an SQL Injection vulnerability in the 404 Solution WordPress plugin (versions up to 3.1.0). The issue is caused by insufficient escaping and improper sanitization of the user-supplied filterText parameter in the ajaxUpdatePaginationLinks AJAX action. Attackers with administrator privileges can bypass the sanitization by using the sequence '*$/', which becomes '*/' after processing, allowing them to escape SQL comment contexts and append additional SQL queries. This enables time-based blind SQL injection attacks to extract sensitive information from the database. The vulnerability does not require user interaction but does require high privileges (administrator).

An attacker with administrator-level access can exploit this vulnerability to perform time-based blind SQL injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure via SQL injection. The CVSS score of 4.9 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch information available at this time. Until a patch is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the ajaxUpdatePaginationLinks AJAX action. Avoid using the vulnerable plugin version if possible.