The Small Package Quotes – For Customers of FedEx WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, the 'edit_id' and 'dropship_edit_id' parameters are vulnerable because user input is insufficiently escaped and the SQL queries are not properly prepared. This enables unauthenticated attackers to append malicious SQL queries to extract sensitive data from the backend database. The vulnerability affects all versions up to 4.3.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the database by injecting malicious SQL commands via vulnerable parameters. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates or patches addressing this vulnerability.