CVE-2026-32552: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in YITH YITH WooCommerce Membership Premium

This vulnerability is an SQL Injection (CWE-89) in YITH WooCommerce Membership Premium versions <= 2.33.0. It allows an attacker with network access and low privileges to inject malicious SQL commands, potentially leading to a confidentiality breach and partial denial of service. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and scope change. Integrity impact is not affected, but confidentiality is high and availability impact is low.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database and limited disruption of service. The attack requires low privileges and no user interaction, making it a significant risk for affected installations. However, there is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply any official patches once released.