The B1.lt WordPress plugin (Site.pro for WooCommerce) suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements on the 'id' parameter in versions up to 2.2.56. Authenticated attackers with at least Subscriber privileges can append malicious SQL commands to existing queries, potentially extracting sensitive data from the backend database. The CVSS 3.1 score is 6.5 (medium), reflecting network attack vector, low attack complexity, and limited privileges required but no impact on integrity or availability.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to extract sensitive information from the database by injecting SQL commands. This compromises confidentiality but does not affect data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges carefully and monitor for suspicious activity related to SQL injection attempts. Avoid granting unnecessary Subscriber-level access to untrusted users.