This vulnerability involves improper neutralization of special elements in SQL commands within the WooCommerce Ultimate Gift Card plugin by WPSwings, enabling Blind SQL Injection attacks. The affected versions include all releases up to 2.9.6. The vulnerability allows remote attackers with no privileges and no user interaction to cause a high confidentiality impact by extracting sensitive data from the database, with a low impact on availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the backend database due to Blind SQL Injection. The integrity of the data is not impacted, and availability impact is low. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if possible to reduce exposure.