This vulnerability, identified as CWE-89, involves improper neutralization of special elements used in SQL commands within Easy Digital Downloads up to version 3.7.0. Specifically, a shop manager with high privileges can exploit this SQL Injection flaw to affect the confidentiality and availability of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information (confidentiality impact) and partial disruption of service (availability impact). Integrity is not impacted according to the CVSS vector. The attacker requires high privileges (shop manager) to exploit this vulnerability, and no user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict shop manager privileges and monitor for suspicious activity related to SQL queries.