This vulnerability involves improper neutralization of special elements in SQL commands within the TicketBAI Facturas para WooCommerce plugin, enabling Blind SQL Injection attacks. The flaw affects all versions up to and including 3.19. Exploitation can be performed remotely without authentication, resulting in high confidentiality impact and partial availability impact. The CVSS v3.1 score is 9.3, indicating critical severity. No vendor advisory or patch links are currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to Blind SQL Injection. The integrity impact is not indicated, but availability impact is low. The vulnerability allows remote attackers to extract information from the backend database without authentication, posing a significant risk to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to it to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.