This vulnerability in WPFactory Email Verification for WooCommerce arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. It affects all versions up to 2.8.10. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is high confidentiality loss and low availability impact. No official patch or mitigation details are currently available from the vendor or other sources.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected system's database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). Integrity impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to it to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.