The WpExperts Hub Woocommerce Partial Shipment plugin (version 3.2 and earlier) contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This allows an attacker with low privileges and no user interaction to execute unauthorized SQL queries remotely over the network, potentially compromising confidentiality and causing limited availability impact. The CVSS v3.1 base score is 8.5, reflecting high severity. No patch or official remediation guidance is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the affected system, potentially exposing sensitive data (high confidentiality impact). The vulnerability does not impact data integrity but may cause limited availability issues. The attack requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's interfaces and monitoring for unusual database activity related to Woocommerce Partial Shipment. Avoid exposing the affected plugin to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.