The Small Package Quotes – Purolator Edition WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of proper query preparation on the 'edit_id' and 'dropship_edit_id' parameters. This vulnerability affects all versions up to 3.6.4 and allows unauthenticated remote attackers to append arbitrary SQL commands to existing queries, enabling unauthorized data extraction from the backend database. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a network attack vector with low complexity, no privileges or user interaction required, and high impact on confidentiality. No patch or official fix has been documented in the provided data.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database without requiring authentication. The integrity and availability of the system are not impacted according to the CVSS vector. This vulnerability poses a high confidentiality risk to affected installations of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to vulnerable parameters through web application firewalls or other filtering mechanisms to mitigate exploitation risk.