Improper neutralization of special elements in an SQL command allows an attacker to inject malicious SQL statements when the Cart tracking for WooCommerce plugin processes user input. This flaw can lead to unauthorized read, modify, or delete operations on the site's database, potentially exposing sensitive customer information or altering transactional data. The vulnerability is classified as CWE‑89, indicating a lack of proper input validation and sanitization in database queries.

The vulnerability affects the wpdever Cart tracking for WooCommerce plugin, versions from the original release through 1.0.16. Any WordPress installation that has this plugin installed and enabled during the affected version range is at risk.

The CVSS score of 7.6 indicates a high severity, while the EPSS score of less than 1% suggests a very low probability of current exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Based on the plugin’s operation within the web application, the likely attack vector is external via HTTP requests that trigger the vulnerable query whenever the plugin processes cart data.