This vulnerability (CWE-89) exists in License Manager for WooCommerce versions up to 3.0.18, where user input is not properly sanitized before being used in SQL commands. This improper neutralization of special elements can lead to SQL Injection attacks. The CVSS 3.1 base score is 7.1, reflecting a network attack vector, high complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The attack requires network access and low privileges but no user interaction. The vulnerability affects the confidentiality of the system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, cautious use and monitoring of the affected software is advised. No vendor-provided mitigation or temporary fix is currently documented.