The Shopper plugin for WordPress incorporates user‑supplied data directly into SQL statements without proper escaping, creating an SQL injection vulnerability. An attacker can inject arbitrary SQL, allowing unauthorized retrieval, alteration, or deletion of data stored in the WordPress database. No code execution or escalation mechanisms are described, but the flaw permits database‑level data compromise.

WordPress installations that have the shopperdotcom Shopper plugin version 3.2.5 or earlier are affected. The vulnerability exists across all versions from the earliest available release up to and including 3.2.5, regardless of other WordPress components.

The CVSS score of 9.3 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that automated exploitation is currently uncommon, and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, accessed through publicly reachable HTTP endpoints that expose the plugin’s vulnerable functionality; authentication is not explicitly required, making it available to any visitor who can reach the WordPress site.