The vulnerability is an SQL injection flaw caused by improper sanitization of user input in the Multiple Shipping And Billing Address For Woocommerce plugin. An attacker who can manipulate the data sent to the plugin can inject arbitrary SQL commands, potentially allowing them to read, modify, or delete data stored in the WordPress site’s database. This can compromise the confidentiality, integrity, and availability of the application, and may serve as a foothold for further exploitation.

The flaw is present in the silverplugins217 Multiple Shipping And Billing Address For Woocommerce plugin for WordPress, versions from the initial release through 1.3. Administrators using any of these versions on a WordPress installation are susceptible, regardless of the WordPress core version or hosting environment.

The CVSS score of 9.3 classifies the issue as critical, and the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation in the wild. The plugin is publicly available and can be called by anyone with access to the site, so an unauthenticated attacker could potentially trigger the injection by submitting crafted requests to the plugin’s endpoints. Because it is not listed in the CISA KEV catalog, there is no known active exploit in the last six months, but the severity warrants immediate attention.