The Premmerce Wholesale Pricing for WooCommerce plugin suffers from improper neutralization of special elements in SQL commands (CWE-89) due to insufficient escaping and lack of prepared statements for user-supplied parameters 'ID' and 'price_type'. Authenticated attackers with at least subscriber privileges can exploit this via the admin-post.php actions 'premmerce_update_price_type' and 'premmerce_delete_price_type' to execute SQL Injection attacks. This allows extraction of sensitive data and unauthorized modification of price type display names in the database, affecting the admin interface's appearance.

Successful exploitation allows an authenticated user with subscriber-level or higher access to extract sensitive information from the database and alter price type display names, leading to confidentiality breaches and integrity issues. There is no impact on system availability. The CVSS 3.1 base score is 7.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact with limited integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions to trusted users only and monitor for suspicious activity related to price type modifications. Avoid using affected plugin versions and consider disabling the plugin if possible until patched.