Lỗi Bảo Mật Code Injection Trong Plugin Của WORDPRESS

public static function alterSearchQuery($search, $query)
{
if( ( (isset($query->query_vars['post_type']) && $query->query_vars['post_type'] == CMDM_GroupDownloadPage::POST_TYPE) && (!isset($query->query_vars['widget']) || $query->query_vars['widget'] !== true) ) && !$query->is_single && !$query->is_404 && !$query->is_author && isset($_GET['CMDsearch']) )
{
global $wpdb;
$search_term = $_GET['CMDsearch'];
if( !empty($search_term) )
{
$search = '';
$query->is_search = true;
// added slashes screw with quote grouping when done early, so done later
$search_term = stripslashes($search_term);
preg_match_all('/".*?("|$)|((?<=[\r\n\t ",+])|^)[^\r\n\t ",+]+/', $search_term, $matches);
$terms = array_map('_search_terms_tidy', $matches[0]);


$n = '%';
$searchand = ' AND ';
foreach((array) $terms as $term)
{
$term = esc_sql(like_escape($term));
$search .= "{$searchand}(($wpdb->posts.post_title LIKE '{$n}{$term}{$n}') OR ($wpdb->posts.post_content LIKE '{$n}{$term}{$n}'))";
}
add_filter('get_search_query', create_function('$q', 'return "' . $search_term . '";'), 99, 1);
remove_filter('posts_request', 'relevanssi_prevent_default_request');
remove_filter('the_posts', 'relevanssi_query');
}
}
return $search;
}