The Product Catalog plugin for WordPress contains a classic SQL injection flaw where un‑sanitized input is concatenated into a database query. Attackers can supply crafted arguments to the displayproduct endpoint, causing arbitrary SQL commands to run. This could result in full database compromise, theft of sensitive customer data, or the insertion of malicious content.

The vulnerability affects the origincode Product Catalog plugin, versions up to and including 1.0.4, when deployed within any WordPress installation that uses the displayproduct feature. No specific operating system or WordPress core version is required for the flaw; any instance that allows external users to interact with the plugin is vulnerable.

With a CVSS score of 9.3 the severity is high, yet the EPSS score is below 1 % and the flaw is not yet in the CISA KEV list, implying exploitation is currently rare. The most likely attack vector is a remote user sending a malicious request to the plugin via the web interface; the attacker does not need authentication. Once exploited, the attacker can perform any actions permitted by the database credentials used by WordPress, which often include full SELECT, INSERT, UPDATE, and DELETE rights.