Certain search strings are not being encoded\/decoded by the plugin correctly and are thus:<\/p>\n
1. Causing the WP_Query SQL string to break, resulting in a WordPress Database error, and
\n2. Exposing a SQL injection vulnerability. It is currently possible to use certain character combinations to inject a single apostrophe (see below). Ack!<\/p>\n
An example search parameter that causes this is: Resulting in error:<\/p>\n I have to disable the plugin and urge everyone else to disable this plugin until the vulnerability has been fixed. Please contact me when this has been patched.<\/p>\n Thank you!<\/p>\n https:\/\/wordpress.org\/plugins\/search-everything\/<\/p>\n","protected":false},"template":"","class_list":["post-7457028","topic","type-topic","status-publish","hentry","topic-tag-decoding","topic-tag-encoding","topic-tag-sql","topic-tag-sql-injection","topic-tag-wordpress-database-error"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/7457028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/7457028\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=7457028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\/?s=A+%5C%27<\/code><\/p>\nWordPress database error: [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%')) OR (((m.meta_value LIKE '%A%') AND (m.meta_value LIKE '%%')) OR (m.meta_va' at line 1]\nSELECT DISTINCT SQL_CALC_FOUND_ROWS wp_posts.* FROM wp_posts LEFT JOIN wp_term_relationships AS trel ON (wp_posts.ID = trel.object_id) LEFT JOIN wp_term_taxonomy AS ttax ON ( ( ttax.taxonomy = 'category' OR ttax.taxonomy = 'post_format' OR ttax.taxonomy = 'action-group' OR ttax.taxonomy = 'product_type' OR ttax.taxonomy = 'product_cat' OR ttax.taxonomy = 'product_tag' OR ttax.taxonomy = 'product_shipping_class' OR ttax.taxonomy = 'tribe_events_cat' OR ttax.taxonomy = 'issue_date' OR ttax.taxonomy = 'project_type' OR ttax.taxonomy = 'project_site' ) AND trel.term_taxonomy_id = ttax.term_taxonomy_id) LEFT JOIN wp_terms AS tter ON (ttax.term_id = tter.term_id) LEFT JOIN wp_postmeta AS m ON (wp_posts.ID = m.post_id) LEFT JOIN wp_users AS u ON (wp_posts.post_author = u.ID) WHERE 1=1 AND ( ( (((((wp_posts.post_title LIKE '%A%') OR (wp_posts.post_content LIKE '%A%')) AND ((wp_posts.post_title LIKE '%%') OR (wp_posts.post_content LIKE '%%'))) OR (((tter.slug LIKE '%a%') AND (tter.slug LIKE '%%')) OR (tter.slug LIKE '%a%')) OR (((ttax.description LIKE '%A%') AND (ttax.description LIKE '%%')) OR (ttax.description LIKE '%A \\\\'%')) OR (((m.meta_value LIKE '%A%') AND (m.meta_value LIKE '%%')) OR (m.meta_value LIKE '%A \\\\'%')) OR (((wp_posts.post_excerpt LIKE '%A%') AND (wp_posts.post_excerpt LIKE '%%')) OR (wp_posts.post_excerpt LIKE '%A \\\\'%')) OR ((u.display_name LIKE '%A%') OR (u.display_name LIKE '%%') OR (u.display_name LIKE '%A \\\\'%')) )) AND wp_posts.post_type IN ('post', 'page', 'attachment', 'nf_sub', 'product', 'wbeexportfile', 'tribe_events', 'tribe_venue', 'programs', 'resources', 'preservationinprint', 'projects') AND (wp_posts.post_status = 'publish' OR wp_posts.post_status = 'acf-disabled' OR wp_posts.post_author = 1 AND wp_posts.post_status = 'private')) AND post_type != 'revision') AND post_status != 'future' ORDER BY (CASE WHEN wp_posts.post_title LIKE '%A \\\\\\\\\\'%' THEN 1 WHEN wp_posts.post_title LIKE '%\\\\\\\\%' THEN 2 WHEN wp_posts.post_excerpt LIKE '%A \\\\\\\\\\'%' THEN 4 WHEN wp_posts.post_content LIKE '%A \\\\\\\\\\'%' THEN 5 ELSE 6 END), wp_posts.post_date DESC LIMIT 0, 12<\/code><\/pre>\n