The Relevanssi Premium plugin's Admin Search AJAX handler accepts a URL-encoded args parameter that is parsed into a WP_Query. User-controlled taxonomy data is sanitized as text but interpolated directly into a term taxonomy lookup SQL query without parameterization. This improper neutralization of special elements (CWE-89) enables authenticated users with contributor-level privileges to inject SQL commands, leading to time-based blind SQL injection against the WordPress database. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, and privileges required at the contributor level.

An authenticated user with contributor-level permissions can exploit this vulnerability to perform time-based blind SQL injection attacks on the WordPress database. This could allow an attacker to extract sensitive information from the database. The vulnerability does not impact integrity or availability directly but has high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level user capabilities if possible and monitor for suspicious activity related to the Admin Search AJAX endpoint. Avoid exposing this functionality to untrusted users.