The B1.lt plugin for WordPress, used within WooCommerce sites, contains a flaw that allows an attacker with Subscriber-level or higher permissions to inject arbitrary SQL code through the 'id' query parameter. The vulnerability stems from insufficient escaping and the lack of prepared statements, enabling malicious actors to append additional SQL statements to existing queries. This can lead to extraction of sensitive data from the database without other external exploitation. The attack requires only authenticated access to the WordPress backend, not a separate network vulnerability.

Any WordPress site running the b1accounting:Site.pro plugin for WooCommerce with a version up to and including 2.2.56 is affected. No newer releases of the plugin contain this issue.

The CVSS base score of 6.5 places this vulnerability in the medium-to‑high severity range. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not included in the CISA KEV catalog. An attacker must first obtain or compromise Subscriber-level credentials, which can be achieved by exploiting weak account passwords or other site weaknesses. Once authenticated, the injection permits reading of database contents, potentially breaching confidentiality and integrity of the e‑commerce data.