CVE-2026-18474

The CVE qualifier 'non-default search field type' is doing more work than most analysts notice. This SQL injection doesn't live in the main search implementation — it's in the secondary code path that activates only when users select a non-standard field configuration. That's the structural tell. Here's why this matters: developers treat default behavior as the 'real' code and non-default branches as peripheral edge cases. When adding a new feature, they typically copy the SQL construction pattern from the default path, which was presumably already secure. What they miss is that a *different parameter* is user-controllable in the new context. The original developer knew to use `esc_sql()` or `wpdb::prepare()` for the default path. The developer who added the non-default branch copied the structure but not the parameter surface awareness. This isn't ignorance of the sanitization functions — WordPress makes those prominent — it's assumption that 'this looks like the other search code, which was already secure.' The unauthenticated trigger compounds the risk. Search forms are public by design, and developers implicitly trust the framework to handle input validation at a layer they aren't directly inspecting. The reconnaissance requirement (attacker must first confirm the non-default configuration is active) doesn't function as a security barrier — it just means the vulnerability sits quieter in logs, which extends the discovery window. For defenders: map data flow across *all* configuration branches, not just default paths. The plugin manages directory listings, meaning the SQL injection reaches business-context data (API keys, submission data, third-party credentials) beyond generic WordPress content. Treat non-default feature branches as high-priority review targets — they're the predictable mutation point where this class of vulnerability appears. Static analysis tools that flag parameter divergence between code paths could catch this pattern automatically. And when triaging, resist the organizational tendency to deprioritize non-default configurations because 'fewer users have that configured' — that framing extends the remediation window without reducing actual exposure.

Reviewed through automated stages and approved by a human before publication.