The WooCommerce Google Feed Manager plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of proper preparation of the 'id' parameter in SQL queries. This flaw affects all versions up to 2.4.2. Authenticated attackers with administrator privileges can exploit this to append arbitrary SQL commands, potentially extracting sensitive data. The vulnerability also poses a risk of malicious script injection by unauthenticated attackers. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory confirming remediation is currently available.

Successful exploitation allows attackers with administrator-level access to execute arbitrary SQL commands, leading to unauthorized disclosure of sensitive information, modification of data, and potential disruption of service. Additionally, unauthenticated attackers may inject malicious web scripts, increasing the risk of further compromise. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using affected versions of the plugin in production environments if possible.