The Productive Commerce WordPress plugin before version 1.1.54 fails to sanitize and escape a user-supplied parameter that is incorporated directly into an SQL statement. This flaw permits an unauthenticated actor to inject arbitrary SQL code, potentially enabling data exfiltration, modification, or other destructive database operations. The weakness is a classic input validation flaw, identified as CWE-89, and can affect the confidentiality, integrity, and availability of the underlying database used by the WordPress site.

The vulnerability applies to WordPress sites that use the Productive Commerce plugin in any release earlier than 1.1.54. No specific sub‑versions beyond that threshold are listed, so all older deployments are potentially impacted while versions 1.1.54 and newer are considered safe.

The CVSS score for this issue is not disclosed, and the EPSS value is unavailable, so the precise probability and severity are unknown. However, the vulnerability is publicly identified and requires no authentication, implying a high attack surface via the web interface. Because it is not listed in CISA's KEV, there is no current evidence of widespread exploitation, but the absence of a CVSS score suggests that the vendor has not released an official quantification. The theoretical likelihood of exploitation remains significant due to the ease of constructing an injec­tive payload in a web context.