The CodeAstro Ecommerce Website version 1.0 contains a SQL injection vulnerability in the /customer/my_account.php script, related to the delete_wishlist argument. This flaw permits remote attackers to manipulate SQL queries by injecting malicious input, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, and no user interaction required. Public exploit code is available, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability can lead to unauthorized SQL command execution on the backend database. This may result in data leakage, data modification, or other database impacts depending on the attacker's input and database privileges. The vulnerability is remotely exploitable without user interaction, increasing its risk. However, the CVSS score and vector indicate limited impact scope and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and parameterized queries on the delete_wishlist parameter to mitigate SQL injection risks. Monitor for updates from CodeAstro regarding patches or official mitigations.