The vulnerability is an uncontrolled SQL injection in the Neon Product Designer For WooCommerce plugin. Unfiltered user input is concatenated into SQL statements, allowing an attacker to execute arbitrary queries. Successful exploitation could lead to unauthorized reading or modification of database contents, potentially compromising confidential data or altering site functionality. The vulnerability is rated high with a CVSS score of 8.5, reflecting its severe impact and the potential for critical data loss or manipulation.

Affected systems include the WordPress plugin Neon Product Designer, developed by vertim, for WooCommerce. All releases up through version 2.2.0 are vulnerable; any installation using this plugin version or earlier must be reviewed. No lower bound is specified, so all installations of 2.2.0 or earlier are considered at risk.

The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the high CVSS score means that if leveraged, the impact would be significant. Likely attack vectors involve remote web requests to the plugin via normal site interactions, such as adding products or customizing designs, which can be triggered by a malicious user. Because the flaw resides in the plugin itself, the primary risk is to the WordPress installation on the affected servers.