The Stylemix Cost Calculator Builder plugin (versions up to 3.2.65) suffers from an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. This flaw enables remote attackers to execute crafted SQL queries without authentication, potentially exposing sensitive information and causing limited denial of service. The vulnerability has a CVSS 3.1 score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity impact.

Successful exploitation could allow an unauthenticated attacker to retrieve sensitive information from the database and cause partial denial of service conditions. The vulnerability does not impact data integrity but poses a high confidentiality risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or disabling it if possible to reduce exposure.