This vulnerability (CVE-2026-32552) is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects YITH WooCommerce Membership Premium versions up to and including 2.33.0. The flaw allows an attacker with low privileges and no user interaction to execute SQL commands that can compromise confidentiality and cause partial denial of service. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and scope change. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could lead to unauthorized disclosure of sensitive data (confidentiality impact is high) and partial service disruption (availability impact is low). Integrity is not impacted. The attacker requires low privileges and no user interaction, increasing the risk of exploitation in vulnerable environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual database activity. Avoid exposing the vulnerable component to untrusted users.