The MailerLite – WooCommerce integration plugin for WordPress contains an SQL injection flaw caused by improper neutralization of special characters in SQL statements. An attacker who can supply input to the plugin’s WooCommerce integration functions can inject arbitrary SQL, allowing read, modify, or delete operations on the database. This could compromise data confidentiality, integrity, and potentially availability if the database is affected.

MailerLite – WooCommerce integration plugin for WordPress; versions up to and including 3.1.2 are vulnerable; earlier versions prior to the fix are also considered susceptible.

The CVSS score of 9.3 reflects a high severity level. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is currently not listed in CISA’s KEV catalog. The likely attack vector is a web request to the plugin’s integration endpoints that accept user input; the presence or absence of authentication requirements is not explicitly stated. Exploitation could lead to arbitrary SQL execution against the database, potentially exposing sensitive data and disrupting application functionality.