The Product Table and List Builder for WooCommerce Lite plugin handles the 'search' request parameter without proper escaping or parameterization. This allows attackers to inject arbitrary SQL fragments that are appended to an existing query. Once executed, the injected code can read sensitive information from the WordPress database. The flaw is a classic SQL injection weakness (CWE‑89). Because the attacker does not need authentication, any user able to issue HTTP requests to the plugin could potentially exploit it.

The vulnerability affects the WordPress plugin Product Table and List Builder for WooCommerce Lite from versions up to and including 4.6.2. The official CNA lists this single product, and no specific sub‑versions are singled out beyond the upper bound.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated HTTP requests directed at the plugin’s 'search' endpoint, which may be reachable from public sites. Successful exploitation requires the attacker to supply a crafted 'search' parameter that contains SQL injection payloads. The absence of authentication or input filtering permits any visitor to trigger the exploited query and obtain database data.