This vulnerability involves improper neutralization of special elements in SQL commands within the acowebs Dynamic Pricing With Discount Rules plugin for WooCommerce (versions up to 4.5.8). It enables blind SQL injection attacks by authenticated users with high privileges, allowing them to extract sensitive information from the database without direct visibility of the data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database. The attack requires high privileges, limiting the threat to users with elevated access. The vulnerability does not impact data integrity but can reduce availability slightly. There are no reports of active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted personnel only and monitor for unusual database query patterns related to the plugin. Avoid exposing administrative interfaces unnecessarily.