This vulnerability involves improper neutralization of special elements in SQL commands within the Woocommerce Quote Calculator plugin by chenyenming. Specifically, it allows Blind SQL Injection attacks, which can be exploited remotely over the network by an attacker with low privileges and without requiring user interaction. The affected versions include all versions up to and including 1.1. The CVSS score is 8.5, indicating a high severity with network attack vector, low attack complexity, and significant confidentiality impact.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). Integrity is not impacted, but availability impact is low. The attacker requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor for vendor updates and consider restricting access to the affected plugin or disabling it until a fix is released. Avoid exposing the plugin to untrusted networks to reduce risk.