The vulnerability is an SQL injection flaw arising from improper neutralization of special characters in SQL statements used by the Magnigenie Review Stars Count For WooCommerce plugin (versions up to and including 2.0). It enables an attacker to inject arbitrary SQL commands, permitting the reading, modification, or deletion of WordPress database contents. This could expose sensitive customer information, corrupt order or review data, and disrupt store operations.

All WordPress sites that installed the Magnigenie Review Stars Count For WooCommerce plugin from its earliest available release through version 2.0 are susceptible. The plugin is commonly used to display customer review stars and counts on WooCommerce stores, so any public-facing WooCommerce site running these plugin versions is at risk.

The CVSS base score of 8.5 denotes high severity, and the EPSS score of less than 1% indicates that exploitation is presently unlikely but not impossible. The issue is not listed in CISA’s KEV catalog. The most probable attack vector is through unfiltered review or rating input submitted via the plugin’s review endpoint; this inference is based on the plugin’s function. Successful exploitation would allow an attacker to alter or compromise the site’s database without requiring additional credentials or system access beyond the ability to submit reviews.