This vulnerability (CVE-2024-22147) in WP Overnight PDF Invoices & Packing Slips for WooCommerce is caused by improper neutralization of special elements in SQL commands (CWE-89), leading to SQL Injection. It affects all versions up to 3.7.5. The CVSS 3.1 score is 7.6 (High), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact is high confidentiality loss and low availability impact. No patch or official remediation is currently documented.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to unauthorized disclosure of sensitive information (confidentiality impact is high) and minor disruption of service (availability impact is low). Integrity impact is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to the plugin. Avoid granting unnecessary high privileges to users interacting with this plugin.