The Flat Shipping Rate by City for WooCommerce plugin is vulnerable to a time‑based SQL injection via the 'cities' parameter. The flaw stems from insufficient input escaping and the absence of prepared statements. This weakness, identified as CWE‑89, permits an authenticated attacker with Shop Manager‑level access or higher to append malicious SQL to the existing query, potentially retrieving confidential data from the WordPress database.

The affected product is the logiceverest Shipping Rates by City for WooCommerce plugin for WordPress. Versions 1.0.3 and any earlier releases are impacted. WordPress sites that have installed these releases and have users with Shop Manager or higher privileges are at risk.

The CVSS score of 4.9 denotes a medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access; attackers must obtain or compromise a Shop Manager–level account or a higher‑privileged account. No publicly available exploits are documented, but the low EPSS does not rule out targeted attempts against WooCommerce installations.