This vulnerability in WPPOOL FlexStock (stock-sync-with-google-sheet-for-woocommerce) arises from improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. It affects all versions up to 3.13.1. The CVSS score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and impacts confidentiality (high) and availability (low). No patch or remediation guidance is currently provided by the vendor or in the advisory.

An attacker with high privileges on the affected system can exploit this vulnerability to perform Blind SQL Injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). There is no indication of integrity impact. Exploitation requires network access and high privileges, limiting the attack surface. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict high-privilege access to the FlexStock plugin and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted networks. Follow vendor communications for updates on official fixes.