The vulnerability is an SQL injection flaw due to improper neutralization of special elements used in an SQL command. Attackers can inject arbitrary SQL, potentially reading, modifying, or deleting database information, leading to significant confidentiality, integrity, and availability impacts as described by CWE-89.

The flaw affects the WooBeWoo Product Filter Pro WordPress plugin in all versions prior to 2.9.6, including the 2.7.6 release referenced in the advisory, and applies to any WordPress site that has the plugin installed and actively processes user‑supplied filter parameters.

With a CVSS score of 9.3 and an EPSS below 1%, the risk is high but the likelihood of automated exploitation is relatively low. The plugin’s filter interface likely accepts untrusted input that is directly interpolated into SQL statements, so a remote attacker could trigger the injection from outside the administrative interface. The vulnerability is not listed in CISA’s KEV catalog, but sites must still address it promptly due to the severe potential impact.