This vulnerability in Ni WooCommerce Cost Of Goods plugin (<= 3.2.8) involves improper neutralization of special elements in SQL commands, commonly known as SQL Injection. It allows an attacker with high privileges to manipulate SQL queries, potentially leading to partial confidentiality loss and limited availability impact. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could lead to unauthorized disclosure of sensitive information (confidentiality impact is high) and limited denial of service (availability impact is low). Integrity impact is not indicated. The attacker must have high privileges to exploit this vulnerability, which limits the attack surface somewhat. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should restrict access to the plugin and ensure only trusted users have high privileges. Monitor for vendor updates and apply any released patches promptly.