This vulnerability involves improper neutralization of special elements in SQL commands within the UpsellWP plugin by flycart, enabling blind SQL injection attacks. The flaw exists in the checkout-upsell-and-order-bumps functionality and affects all versions up to 2.2.4. The CVSS v3.1 base score is 7.6, indicating a high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change. Confidentiality impact is high, integrity impact is none, and availability impact is low.

An attacker with high privileges can exploit this vulnerability remotely to perform blind SQL injection, which may lead to unauthorized disclosure of sensitive information from the database. The integrity of data is not impacted, but availability may be slightly affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to the UpsellWP plugin. Avoid exposing the affected functionality to untrusted users.