This vulnerability arises when the PersianWoocommerceSMS plugin fails to properly neutralize special characters in SQL commands, allowing an attacker to inject malicious SQL. The injected statements can read, modify, or delete database contents, resulting in loss of confidential data, corruption of order records, or unauthorized account changes. The weakness corresponds to CWE‑89 and carries a CVSS score of 7.6, indicating a high‑severity flaw.

The issue affects versions of the PersianWoocommerceSMS plugin through 7.0.10, distributed by PersianScript. Any WordPress site that has installed this plugin, especially those that have not applied the 7.0.11 update to date, is susceptible.

The EPSS score indicates that exploitation probability is below 1 % and the flaw is not listed in CISA’s KEV catalog, suggesting limited known use in the wild. However, the high CVSS value and the generic nature of SQL injection mean that a malicious actor could likely exploit the flaw if the site is publicly reachable and the plugin is enabled. The attack vector is inferred to be remote via crafted HTTP requests to the plugin’s endpoints, requiring no authentication.