The vulnerability is an improper neutralization of special elements in SQL commands, classified as a classic SQL Injection flaw, CWE‑89. It allows an attacker to insert arbitrary SQL statements through the plugin’s input handling, potentially compromising the integrity and confidentiality of the database and enabling unauthorized data disclosure or modification.

The flaw affects Martin Nguyen’s Next‑Cart Store to WooCommerce Migration plugin versions from the first release through 3.9.4. Any WordPress site that has this plugin installed and has not upgraded to a later release is susceptible.

With a CVSS score of 9.3, the vulnerability is considered Critical. The EPSS score is less than 1%, indicating a low but non‑zero probability of exploitation in the wild, and the issue is not on the CISA KEV list. The likely attack vector is remote, emanating from web traffic that interacts with the plugin’s migration interface; it is inferred that an attacker could exploit the flaw by submitting crafted input via a standard HTTP request.