This vulnerability (CVE-2024-43917) in TemplateInvaders TI WooCommerce Wishlist plugin is caused by improper neutralization of special elements in SQL commands, classified as CWE-89 (SQL Injection). It allows remote attackers to inject SQL code without authentication, potentially leading to unauthorized data disclosure. The affected versions include all releases up to 2.8.2. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix has been announced by the vendor as of the publication date.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information. The vulnerability impacts confidentiality severely, with limited impact on availability and no impact on integrity. There are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the TI WooCommerce Wishlist plugin or restricting access to it to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.