Improper neutralization of special elements used in an SQL command allows attackers to inject arbitrary SQL via the Amazon Native Shopping Recommendations plugin. This flaw can enable reading, modifying, or deleting database records, potentially exposing sensitive information such as user data, orders, or site configuration. The vulnerability aligns with CWE‑89 and can be leveraged to execute commands against the WordPress database from an external vector that the plugin processes.

WordPress installations that employ the AA‑Team Amazon Native Shopping Recommendations plugin, specifically any version up to and including 1.3. Sites that rely on this plugin for product recommendations are at risk if the plugin remains at an affected version.

The CVSS score of 9.3 marks this as a high‑severity flaw. The EPSS score of less than 1% suggests that exploit attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog, indicating no widely known public exploits. However, the attack vector is likely a web‑based request that the plugin accepts, and because the plugin may be used by many WordPress sites, the potential for successful exploitation remains significant if any user input is reflected in SQL queries.