This vulnerability in Crocoblock JetSearch (<= 3.5.10) arises from improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. An attacker can exploit this flaw remotely without authentication (AV:N/AC:L/PR:N/UI:N) to extract sensitive data (C:H) while causing limited availability impact (A:L). The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details. It affects the JetSearch plugin, commonly used in WordPress environments.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database due to Blind SQL Injection. The vulnerability does not directly allow data modification or deletion but can impact system confidentiality severely and cause limited availability issues. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the JetSearch plugin or restricting access to it to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.