This vulnerability (CVE-2026-73346) is an SQL Injection flaw classified under CWE-89 in MailChimp For WooCommerce versions before 6.2. It arises from improper neutralization of special elements used in SQL commands, enabling an attacker with administrator privileges to inject malicious SQL. The CVSS 3.1 score is 7.6 (high), with network attack vector, low attack complexity, required privileges at the administrator level, no user interaction, and impacts confidentiality (high) and availability (low). The vulnerability is published but no vendor remediation or patch is currently documented. The affected versions are those prior to 6.2, though this is inferred from the description rather than explicitly stated in version format.

An attacker with administrator privileges can exploit this vulnerability to perform SQL injection attacks, potentially leading to full confidentiality compromise of the database and partial denial of service. Integrity impact is not indicated. The attack requires administrator privileges and can be performed remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict administrator access and monitor for suspicious activity related to SQL injection attempts.