This vulnerability in Ihor Kit Shipping for Nova Poshta (up to version 1.19.6) arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The flaw allows remote attackers with no privileges and no user interaction to execute arbitrary SQL commands, potentially leading to high confidentiality impact such as unauthorized data disclosure. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. No vendor advisory or patch links are provided, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL Injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin or environment and monitor for suspicious activity related to SQL Injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.