The Themify – WooCommerce Product Filter plugin for WordPress suffers from a time-based SQL Injection vulnerability via the 'conditions' parameter. This occurs because user input is not properly escaped or prepared before being included in SQL queries, enabling unauthenticated attackers to append malicious SQL commands. This vulnerability affects all versions up to 1.4.9 and can be exploited to extract sensitive data from the underlying database. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, modification of data, or disruption of service. The critical CVSS score (9.8) reflects the severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected plugin's functionality, apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'conditions' parameter, and monitor for suspicious activity related to this vulnerability.