The PPOM – Product Addons & Custom Fields for WooCommerce plugin suffers from an SQL Injection vulnerability (CWE-89) in the PPOM_Meta::get_fields_by_id() function due to insufficient escaping of user-supplied input and lack of proper query preparation. This allows unauthenticated attackers to append arbitrary SQL queries to existing ones, potentially exposing sensitive data from the database. Exploitation requires the 'Enable Legacy Price Calculations' setting to be enabled. The vulnerability affects all versions up to and including 33.0.15. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. It can be triggered remotely without authentication, increasing the risk to affected installations that have the vulnerable setting enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the 'Enable Legacy Price Calculations' setting to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.