The vulnerability allows users with Contributor privilege and higher to insert arbitrary SQL fragments into custom filter rules, which are subsequently embedded in database queries without proper sanitisation or escaping. This permits the injection of arbitrary SQL statements that can read, modify, or delete data stored in the WordPress database, directly impacting the confidentiality, integrity, and potentially the availability of the site.

The affected component is the Product Feed Manager For WooCommerce WordPress plugin. Versions prior to 7.6.1 are vulnerable. Based on the description, it is inferred that the plugin runs on any WordPress installation that can install third‑party plugins, and the issue is tied to the internal handling of product‑feed filter rules.

Exploitation requires at least Contributor level access to create or edit filter rules. If an attacker can supply a crafted rule, injected SQL will execute with the database privileges of the WordPress installation, typically full read/write access to site data. The CVSS score of 8.1 indicates high severity. The EPSS score is very low, <1%, and the plug‑in is not listed in the KEV catalogue, but the capability for arbitrary query execution means the risk is high and should be treated as a critical vulnerability.