WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t…

CVE-2018-25434 is an SQL injection vulnerability in WP AutoSuggest version 0.24 that allows unauthenticated attackers to execute arbitrary SQL queries. The vulnerability exists in the wpas_keys parameter of the autosuggest.php file. Attackers can exploit this by sending crafted GET requests to extract sensitive database information from WordPress posts and other database tables. The vulnerability poses a significant risk as it requires no authentication and can lead to complete database compromise. Multiple exploit resources and advisories are available documenting this vulnerability.