The PagBank / PagSeguro Connect para WooCommerce plugin contains a SQL injection flaw caused by inadequate escaping of the 'status' parameter in the plugin’s database queries. This weakness, classified as CWE-89, enables an attacker who is authenticated with Shop Manager level access or higher to append malicious SQL statements to the existing query, potentially allowing the extraction of sensitive database information.

The vulnerability affects the martins56 PagBank / PagSeguro Connect para WooCommerce WordPress plugin in all releases up to and including version 4.44.3. Any WordPress site that has this plugin installed and whose users include accounts with Shop Manager or higher privileges is potentially impacted.

The CVSS score of 4.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The attacker must first have valid credentials with Shop Manager or better privileges; once authenticated, they can exploit the flaw by sending a crafted request containing the 'status' parameter. The vulnerability is not listed in CISA’s KEV catalog, but because it allows data exfiltration from the database, the risk to confidentiality remains significant for compromised sites.