An injection flaw exists in the vanquish WooCommerce Orders & Customers Exporter plugin, where special SQL keywords are not properly escaped. A malicious actor can insert arbitrary SQL fragments via exposed input, enabling the execution of unintended SQL commands. This could allow the attacker to read, modify, or delete stored data, leading to sensitive information exposure, configuration tampering, or service disruption.

The vulnerability affects the vanquish WooCommerce Orders & Customers Exporter plugin, versions up to and including 5.4. All installations of this plugin within that range are at risk.

The CVSS score of 8.5 indicates a high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the flaw is not listed in CISA’s KEV catalogue. Likely, the attack vector involves a web request to the plugin’s export endpoint, which may be accessible to authenticated users or administrators. Given the nature of SQL injection, a remote attacker with sufficient privileges could use the flaw to exfiltrate data or alter the database.