The SIP Reviews Shortcode for WooCommerce plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of proper preparation of the 'no_of_reviews' attribute in the woocommerce_reviews shortcode. This flaw allows unauthenticated attackers to append malicious SQL queries to existing database queries, potentially exposing sensitive information. The vulnerability affects all versions up to and including 1.2.3. There is no indication of known exploits in the wild or an available patch at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect integrity or availability but compromises confidentiality. Because the attacker can inject SQL commands without authentication, the risk is elevated. However, the CVSS score of 6.5 reflects a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin or restricting access to the shortcode functionality to trusted users only. Monitor vendor channels for updates and apply any official patches promptly once available.