Improper neutralization of special elements in SQL commands allows an attacker to inject arbitrary SQL queries into the database. This flaw can lead to unauthorized data disclosure or manipulation, compromising the confidentiality and integrity of the site's data. The weakness stems from a classic payload injection vulnerability (CWE-89).

WordPress sites using the GG Bought Together for WooCommerce plugin by wpopal, versions up to and including 1.0.2 are vulnerable. No other product versions are known to be affected.

The CVSS score of 9.3 indicates a critical severity. Although the EPSS score is less than 1%, suggesting low current exploitation probability, the vulnerability remains unlisted in the CISA KEV catalog. Based on the description, the likely attack vector is via crafted POST requests or manipulated URLs that target the plugin’s input handling code, requiring only access to the plugin’s input handling context. Given the critical score and the irreversible nature of SQL injection, the risk requires urgent attention.