The flaw is a blind SQL injection in moosocial Store Plugin 2.6 that is triggered by the product parameter through URL rewriting. Attackers can supply boolean‑based, time‑based or stacked query payloads to the product URI and progressively reveal database contents without needing an error response. This permits the unauthorized extraction of sensitive data, compromising the confidentiality and integrity of the stored information.

Moosocial’s moosocial Store Plugin, version 2.6, which is the only version explicitly affected by the listed vulnerability. No other versions are mentioned in the CNA data.

The CVSS score of 8.8 indicates a high‑severity vulnerability, and the lack of a publicly documented exploit or KEV listing suggests that no widespread exploitation is presently known. However, the EPSS score is not available, which does not diminish the likelihood of targeted attacks given the unauthenticated nature of the flaw. The likely attack vector is an unauthenticated HTTP request to a publicly reachable URL that includes a malformed product parameter; this can be performed remotely over the network without prior access or credentials.