This vulnerability (CVE-2026-57683) is an improper neutralization of special elements used in an SQL command (CWE-89) in the WP Fast Total Search plugin for WordPress, specifically affecting versions up to 1.80.280. It allows unauthenticated attackers to perform SQL Injection attacks remotely, which can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. No official patch or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected system, leading to high confidentiality impact by exposing sensitive data. Integrity impact is not indicated, and availability impact is low, possibly causing limited denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.