The flaw lies in the PPOM_Meta::get_fields_by_id() function where user input is not escaped and the resulting SQL query is not prepared, allowing an unauthenticated attacker to inject arbitrary SQL. By appending malicious statements to the query, the attacker can retrieve sensitive data from the WordPress database, such as customer records, order information, or other private tables, leaking confidential information.

The vulnerability affects the themeisle PPOM – Product Addons & Custom Fields for WooCommerce plugin from all versions up to and including 33.0.15. It is only exploitable when the Enable Legacy Price Calculations setting is enabled.

The CVSS score of 7.5 signals a high severity, while an EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in CISA's KEV catalog. The likely attack path requires sending crafted HTTP requests to the plugin's endpoint with the Enable Legacy Price Calculations setting enabled; no authentication is needed. Successful exploitation gives an attacker the ability to read all data returned by the vulnerable query, compromising confidentiality across the site.