An authenticated subscriber can trigger the b1_run_query AJAX action that lacks a proper capability check. The flaw allows the attacker to inject and execute arbitrary SQL statements. This can lead to the disclosure of sensitive data, unauthorized modification or deletion of database contents, and potentially compromise the integrity and confidentiality of the entire site.

The vulnerability affects the B1.lt plugin for WordPress, integrated with WooCommerce and sold by b1accounting:Site.pro. Versions 2.2.57 and earlier are impacted. Site owners running those versions should check the installed version and plan to upgrade.

The CVSS score of 8.8 reflects a high severity. EPSS indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with at least Subscriber-level access, which is normally granted to regular customers. Once authenticated, the attacker can dispatch the vulnerable AJAX endpoint and supply malicious SQL payloads. The lack of authorization control (CWE-862) is the root cause.