Improper input sanitization in the WPSwings WooCommerce Ultimate Gift Card plugin allows attackers to execute arbitrary SQL commands against the database. The vulnerability is a blind SQL injection, meaning the attacker may not receive immediate feedback but can infer data through response timing or other side‑channels. If exploited, an attacker could read, modify, or delete sensitive data such as customer orders, payment information, or store configuration, and potentially gain persistent access to the site’s backend. The weakness is identified as CWE-89, which indicates lack of proper SQL query handling.

All installations of the WPSwings WooCommerce Ultimate Gift Card plugin version 2.9.6 or earlier are affected. The plugin is commonly used on WordPress sites to manage gift card functionality. No other vendors or products are listed.

The CVSS score of 9.3 indicates a critical severity with high impact and ease of exploitation. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to target the plugin’s input endpoints, likely via crafted requests that trigger hidden SQL statements. Because the vulnerability is blind, detection requires monitoring for abnormal responses or traffic patterns. Overall, the risk remains high due to the potential for full database compromise, but current exploitation probability is low.