The Conversios plugin for WordPress, used for Google Analytics 4, Google Ads, and conversion tracking, contains a time-based SQL Injection vulnerability (CWE-89) in the ee_syncProductCategory function. This flaw is due to improper neutralization of special elements in SQL commands, specifically insufficient escaping of user-supplied parameters (conditionData, valueData, productArray, exclude, and include). Authenticated attackers with subscriber or higher privileges can append additional SQL queries to existing ones, potentially extracting sensitive data from the database. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet.

Successful exploitation allows authenticated users with subscriber-level access or higher to perform time-based SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information, modification of data, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious activity related to the ee_syncProductCategory function. Avoid using affected plugin versions (up to 7.0.7) in sensitive environments if feasible. Follow vendor channels for updates on patches or mitigations.