This vulnerability in the Review Stars Count For WooCommerce plugin (versions <= 2.0) arises from improper neutralization of special elements used in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. The plugin is not a cloud service, and no patch or official fix information is currently provided.

Successful exploitation could allow an attacker with low privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin functionality to trusted users only and monitor for unusual database activity related to the plugin. Avoid exposing administrative interfaces publicly.