This vulnerability in BeRocket Brands for WooCommerce arises from improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. It affects all versions up to 3.8.6.3. An attacker with low privileges can exploit this remotely without user interaction, potentially causing a complete confidentiality breach of the database and limited denial of service. The CVSS score of 8.5 reflects the high impact on confidentiality and low attack complexity.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the backend database (high confidentiality impact) and may cause limited denial of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's functionality to trusted users only and applying web application firewall rules to detect and block SQL injection attempts targeting this plugin.