This vulnerability allows an authenticated user with Subscriber-level access or higher to inject arbitrary SQL through the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action. The code fails to properly escape the user-supplied input and the SQL query is not adequately prepared, enabling an attacker to append additional statements. The outcome is the potential extraction of sensitive information from the WordPress database, which undermines confidentiality.

All installations of the Hyyan WooCommerce Polylang Integration plugin for WordPress with versions up to and including 1.5.0 are affected. Users should check their installed version against vendor release notes to determine impact.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that active exploitation is unlikely at this time, and the vulnerability is not listed in CISA’s KEV catalog. Attack requires an authenticated user with Subscriber-level access to invoke the vulnerable AJAX endpoint, which can be done remotely from the site’s web interface. Once triggered, injected SQL can read arbitrary tables, potentially exposing user data, order histories, or other sensitive information. The requirement for authentication limits exploitation to existing site users, but the breadth of data at risk warrants high vigilance.