The vulnerability allows a blind SQL injection in the MyStyle Custom Product Designer WordPress plugin, permitting an attacker to craft inputs that cause the plugin to construct malformed SQL commands. Although the injection is blind, the attacker can determine the truth of conditional queries and thus infer, read, alter, or delete data stored in the WordPress database. This represents a serious risk to data confidentiality and integrity, potentially exposing sensitive user or configuration information.

WordPress sites using the mystyleplatform MyStyle Custom Product Designer plugin with versions up to and including 3.21.1 are affected. The vulnerability is not tied to a particular operating system or PHP version, but any installation deploying the plugin within this version range is susceptible.

The CVSS score of 9.3 indicates a high severity, and the EPSS score of 7% suggests the issue is considered likely to be exploited. The vulnerability is not yet listed in the CISA KEV catalog. The attack vector would involve an attacker sending crafted requests to the plugin’s input fields, possibly through the WordPress front‑end or administration interface. Because the attack is blind, successful exploitation requires inference over time but can still be achieved remotely without authentication if the plugin accepts untrusted input.