This vulnerability involves improper neutralization of special elements in SQL commands within the APIExperts Square for WooCommerce plugin, enabling blind SQL injection. An attacker with network access and low privileges can exploit this to extract sensitive information from the database (confidentiality impact) without modifying data integrity but causing limited availability impact. The CVSS 3.1 base score is 8.5, reflecting high severity. The affected versions include all versions up to and including 4.7.4. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the backend database (high confidentiality impact). The integrity of data is not impacted, but availability may be slightly affected (low impact). This could compromise the security of the WooCommerce environment using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the affected plugin functionality and monitoring for suspicious activity. Avoid exposing the vulnerable plugin to untrusted networks or users with low privileges.