The levelfourstorefront Shopping Cart & eCommerce Store WordPress plugin suffers from a boolean-based SQL Injection vulnerability via the 'model_number' parameter. This occurs because user input is insufficiently escaped and the SQL queries are not properly prepared, enabling authenticated attackers with Contributor or higher privileges to append additional SQL commands. The vulnerability impacts all plugin versions up to 5.7.2. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the Contributor level. Exploitation can lead to high impact on confidentiality, integrity, and availability of the affected system's database.

Successful exploitation allows authenticated users with Contributor-level access or higher to perform SQL Injection attacks, potentially extracting sensitive information from the database and compromising the application's confidentiality, integrity, and availability. This could lead to data leakage, unauthorized data manipulation, or denial of service conditions within the affected WordPress plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict Contributor-level access to trusted users only and monitor for unusual database activity related to the 'model_number' parameter. Avoid exposing the vulnerable plugin to untrusted users with Contributor or higher privileges. Stay updated with vendor communications for any forthcoming patches or mitigations.