The Recurio plugin for WooCommerce contains a generic SQL injection flaw where the 'data' parameter is concatenated into a database query without proper escaping or preparation. Attackers who are authenticated with shop manager role or higher can inject additional SQL statements through that parameter, allowing them to read or modify sensitive data in the database. The weakness is classified as CWE‑89.

WordPress installations that use Recurio version 1.1.3 or earlier are affected. Any site that has not upgraded past that release and assigns shop-manager privileges to a user can exploit the vulnerability. The vulnerable code resides in core/class-subscription-engine.php around lines 1095 and 301, as referenced in the plugin source.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of public exploitation at the time of this analysis. The flaw is not listed in CISA’s KEV catalog. Exploitation requires authenticated shop-manager level access; unauthenticated users cannot abuse the bug. Once access is gained, the attacker can append arbitrary SQL to read sensitive database content, but no widely available exploit exists. The risk is therefore moderate but actionable.