This vulnerability in the Cart tracking for WooCommerce plugin (versions <= 1.0.17) arises from improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 7.6 (High), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No known exploits in the wild or vendor patches have been reported as of the published date.

An attacker with high privileges on the system could exploit this vulnerability to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict high-privilege access to the affected plugin and consider disabling or removing the plugin if feasible.