The vulnerability is an instance of improper neutralization of special elements used in an SQL command (CWE-89). The affected Trust Payments Gateway for WooCommerce plugin processes user data without adequate sanitization, enabling an attacker to inject arbitrary SQL. Successful exploitation could let the attacker read, modify, or delete database content, potentially compromising sensitive customer payment information and disrupting site operations.

The Trust Payments Gateway for WooCommerce plugin for WordPress, versions up to and including 1.1.4, is affected. Any WordPress site running this plugin without an update to 1.1.5 or later is at risk.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS score of less than 1% indicates a low probability that the vulnerability is actively exploited at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits have been documented. Based on the description, the likely attack vector involves sending crafted requests to the plugin’s endpoints, though the exact path is not detailed in the advisory. Because the flaw grants unauthenticated SQL execution, the risk is broadly available to anyone who can interact with the site.