This vulnerability in License Manager for WooCommerce arises from improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. It affects all versions up to 3.0.12. The CVSS 3.1 score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, but no integrity impact. No vendor advisory or patch links are currently provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with high privileges to perform Blind SQL Injection, potentially exposing sensitive data (confidentiality impact) and causing limited denial of service (availability impact). Integrity of data is not affected. The vulnerability requires the attacker to have high privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin to trusted users only and monitor for unusual activity. Avoid exposing the plugin to untrusted networks or users with elevated privileges.