This vulnerability involves improper neutralization of special elements in SQL commands within the Product Rearrange for WooCommerce plugin by Devteam HaywoodTech. It allows unauthenticated remote attackers to conduct Blind SQL Injection attacks, which can lead to unauthorized disclosure of sensitive information. The issue affects all versions up to 1.2.2. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact with limited integrity and availability impact. No patch or mitigation details are currently provided.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection, potentially extracting sensitive data from the backend database. The confidentiality impact is high, while integrity and availability impacts are low. This could lead to data exposure but does not directly allow data modification or denial of service based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin if possible. Monitor official Devteam HaywoodTech communications for updates. No vendor advisory or official fix information is currently provided.