The vulnerability resides in the SIBS WooCommerce payment gateway plugin for WordPress. An authenticated user with Administrator level or higher privileges can supply a crafted ‘referencedId’ parameter that is concatenated into an SQL statement without proper escaping or prepared statement usage. This leads to a time‑based SQL injection that conforms to CWE‑89 and allows the attacker to execute arbitrary SQL queries against the underlying database, thereby reading sensitive information and compromising the confidentiality of all site data.

All versions of the SIBS WooCommerce payment gateway plugin up to and including 2.2.0 are affected. WordPress sites that have installed any of these versions are within the risk scope, especially those with users possessing Administrator or higher roles.

The CVSS score of 4.9 places the flaw in the medium severity range, while an EPSS of less than 1 percent indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Administrator level, meaning the threat vector is limited to compromised administrator accounts or internal actors. Successful exploitation enables complete read access to the site’s database content.