This vulnerability (CVE-2024-43132) in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) arises from improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It affects versions prior to 1.7.0 and allows remote attackers to inject malicious SQL queries without authentication or user interaction. The CVSS 3.1 score of 9.3 reflects critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change impacting confidentiality and availability. No patch or official remediation level has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the affected system, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability is remotely exploitable without authentication or user interaction, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor for vendor updates and consider restricting access to the affected plugin or disabling it until a patch is available. Avoid exposing the vulnerable plugin to untrusted networks where possible.