This vulnerability, identified as CWE-89, is a SQL Injection flaw in WordPress.com eShipper Commerce affecting versions up to 2.16.13. The flaw allows an attacker with low privileges to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The CVSS 3.1 score is 8.5, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and scope changed. The impact includes high confidentiality impact and low availability impact, with no integrity impact. There is no vendor advisory or patch information available at this time.

An attacker with low privileges can exploit this SQL Injection vulnerability remotely without user interaction. The exploitation can lead to a complete compromise of confidentiality (e.g., unauthorized data disclosure) and a limited denial of service. Integrity is not impacted. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts.