The B1.lt plugin for WordPress, specifically the 'Site.pro for WooCommerce' product, suffers from a missing capability check on the b1_run_query AJAX action. This missing authorization allows authenticated users with low privileges (Subscriber-level and above) to run arbitrary SQL commands via SQL Injection. The vulnerability affects all versions up to and including 2.2.57. The CVSS v3.1 score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access can exploit this vulnerability to execute arbitrary SQL queries on the backend database. This can lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise. The high CVSS score (8.8) indicates severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — no patch or official fix information is provided in the available data. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, restrict Subscriber-level access to trusted users only and consider disabling or limiting the use of the vulnerable AJAX action if possible.