The vulnerability is a classic SQL injection flaw (CWE‑89) affecting the Dynamic Pricing With Discount Rules for WooCommerce plugin up to version 4.5.8. Malicious actors can inject crafted input into the plugin’s query processing, causing the application to execute arbitrary SQL commands against the underlying database. Although the injection is blind, an attacker can infer data through timing or error messages, enabling exfiltration of sensitive user or order information and compromising database integrity.

WordPress sites that have the Dynamic Pricing With Discount Rules for WooCommerce plugin version 4.5.8 or earlier installed. The flaw exists wherever the plugin’s pricing rule forms are accessible, including the standard WordPress admin interface.

The CVSS score of 7.6 indicates high severity, and the EPSS score of less than 1% suggests a low probability of observed exploitation in the wild. The attack vector is likely through legitimate plugin usage: a user or administrator interacting with the pricing rule form could trigger the injection. The vulnerability is not listed in CISA KEV, but it remains critical for sites relying on this plugin.