This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89) in the Category Discount Woocommerce plugin by Vidish. Specifically, versions up to 5.18 are affected by an administrator-level SQL Injection flaw. The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, required privileges of high, no user interaction, and scope changed. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No known exploits are reported in the wild. No vendor advisory or patch information is available.

An attacker with administrator privileges can exploit this SQL Injection vulnerability to compromise confidentiality of the database and cause partial denial of service. Integrity is not impacted. The vulnerability could allow unauthorized data disclosure or disruption of service within the affected plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the plugin.