This vulnerability involves improper neutralization of special elements used in an SQL command within the VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin. Specifically, it allows blind SQL injection, enabling an attacker with network access and low privileges to execute crafted SQL commands that can compromise data confidentiality. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. The affected versions are all versions prior to 1.0.29.

An attacker with low privileges and network access can exploit this vulnerability to perform blind SQL injection attacks, potentially exposing sensitive data (high confidentiality impact). The integrity is not impacted, but availability may be slightly affected (low impact). There is no evidence of known exploits in the wild at this time.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts.