Improper neutralization of special characters used in an SQL command allows an attacker to inject arbitrary SQL statements. This flaw falls under CWE-89 and can result in data exfiltration, modification, or deletion if exploited. The vulnerability exists in the "ELEX Product Feed for WooCommerce" plugin and allows attackers to manipulate database queries, potentially compromising the entire WordPress site. The impact is a loss of data confidentiality, integrity, and availability for affected users.

ELEXtensions’ "ELEX Product Feed for WooCommerce" plugin, versions from the earliest available releases through 3.1.2, is vulnerable. All WordPress installations utilizing these plugin versions are at risk, regardless of other security controls in place.

The CVSS score of 7.6 indicates a high severity flaw. The EPSS score of less than 1% suggests that it is unlikely to be widely exploited currently, and the lack of listing in the CISA KEV catalog confirms no public exploitation reports at this time. Likely attack vectors involve remote exploitation through crafted HTTP requests to the plugin’s feed generation endpoints, as the plugin accepts user‑supplied input without proper sanitization. An attacker with sufficient access to submit such requests can execute SQL queries against the database.