This vulnerability in the Order Splitter for WooCommerce plugin (versions <= 5.3.0) allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The plugin is not a cloud service. No patch or official remediation details are provided in the available data.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute crafted SQL commands, potentially leading to partial disclosure of sensitive data (confidentiality impact) and minor disruption of service (availability impact). Integrity is not impacted according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting access to the plugin functionality to trusted users only and monitor for unusual database activity related to the plugin. Avoid exposing the affected plugin to untrusted users.